The vulnerability in benoitc hackney arises from the Alt-Svc response header parser in src/hackney_altsvc.erl, where parse_token/2 and skip_comma/1 functions fail to advance the parsing buffer upon encountering certain non-token, non-whitespace, non-comma bytes. This causes parse_entries/2 to enter a tight infinite tail-recursive loop, consuming 100% CPU on a scheduler and causing the calling connection process to hang indefinitely. The entry point parse_and_cache/3 is synchronously called on every HTTP response, making this a readily triggerable denial-of-service condition by sending a single-byte Alt-Svc header with a problematic character. The issue affects hackney versions from 2.0.0-beta.1 up to but not including 4.0.1.

An attacker controlling an HTTP origin can cause a denial-of-service condition by sending a crafted Alt-Svc header that triggers an infinite loop in the hackney client. This results in a scheduler being pinned at 100% CPU and the connection process hanging indefinitely, potentially disrupting client operations that rely on hackney for HTTP communication. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround is currently documented. Users should monitor vendor communications for updates and consider mitigating exposure by restricting or validating Alt-Svc headers from untrusted origins if feasible.