The vulnerability in benoitc hackney's WebSocket client arises from lack of upper bounds on memory consumption in three areas: (1) read_handshake_response/3 accumulates bytes indefinitely if the server streams data without completing the handshake delimiter, (2) parse_payload/9 and parse_active_payload/8 do not validate frame payload length, allowing very large frames to cause memory exhaustion, and (3) the frag_buffer field accumulates continuation frames indefinitely if the server sends endless fragmented frames without a final frame. These flaws allow a malicious WebSocket server to cause the client to consume excessive memory, leading to denial of service. The issue affects hackney versions from 2.0.0 up to but not including 4.0.1.

Successful exploitation results in uncontrolled memory consumption on the client side, potentially causing out-of-memory conditions and denial of service. The attacker must control the WebSocket server the client connects to but does not require authentication or special client configuration. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting exposure to untrusted WebSocket servers or implementing external controls to detect and block malicious WebSocket traffic. Monitor vendor channels for updates regarding patches or official mitigations.