The vulnerability in benoitc hackney's WebSocket client arises from lack of limits on memory usage in three areas: (1) read_handshake_response/3 accumulates bytes indefinitely if the server never sends the expected \r\n\r\n sequence, (2) parse_payload/9 and parse_active_payload/8 do not enforce limits on declared frame payload lengths, allowing extremely large frames to cause memory exhaustion, and (3) the frag_buffer field accumulates fragmented frames indefinitely if the server sends continuous non-final fragments without a final frame. Exploitation requires control of the WebSocket server the client connects to and affects hackney versions from 2.0.0 up to but not including 4.0.1.

Successful exploitation can cause the hackney WebSocket client to consume excessive memory, potentially leading to denial of service through out-of-memory conditions. This impacts any application using affected hackney versions when connecting to a malicious or compromised WebSocket server. There is no need for authentication or special client configuration to trigger the issue.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently provided. Users should monitor the vendor's announcements for updates. Until a fix is available, avoid connecting hackney WebSocket clients to untrusted or potentially malicious WebSocket servers to reduce risk.