The vulnerability in benoitc hackney (CVE-2026-47077) involves the Flooding.hackney_h3:await_response_loop/6 function accumulating HTTP/3 response body data in memory without any size cap. The after Timeout clause used is a per-message inactivity timer that resets on each received chunk but does not impose a total time limit. A malicious HTTP/3 server can send one small chunk every Timeout minus 1 millisecond with Fin=false and never send a final frame, keeping the loop alive indefinitely. This causes the accumulation buffer to grow linearly without bound, eventually exhausting the BEAM process heap and causing an out-of-memory condition. This affects hackney from version 2.0.0 before 4.0.1, with the specifically stated affected version being 2.0.0.

Successful exploitation allows a malicious HTTP/3 server to cause a denial of service by exhausting the memory of the client process running hackney, leading to an out-of-memory crash. This can disrupt applications relying on hackney for HTTP/3 communication, potentially causing service interruptions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Users should monitor the vendor's announcements for updates. Until a fix is available, avoid interacting with untrusted or malicious HTTP/3 servers that could exploit this vulnerability.