The vulnerability in benoitc hackney's SOCKS5 transport occurs because the timeout value used during SOCKS5 negotiation is not forwarded when the connection is upgraded to TLS via ssl:connect/2, which defaults to an infinite timeout. A malicious SOCKS5 proxy can exploit this by completing the handshake and then stalling during the TLS handshake, causing the client process to block indefinitely. This uncontrolled resource consumption can result in denial of service conditions. The affected versions are from 0.10.0 up to but not including 4.0.1.

An attacker controlling a SOCKS5 proxy can cause the client process using hackney to block indefinitely, leading to resource exhaustion and potential denial of service. This can disrupt applications relying on hackney for network communication through SOCKS5 proxies. There is no indication of data compromise or privilege escalation from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's announcements for updates. Until a fix is available, avoid using untrusted SOCKS5 proxies or implement external timeout controls at the application or network level to mitigate indefinite blocking.