This vulnerability (CWE-400) in benoitc hackney arises because the HTTP/3 response handling loop accumulates response data in memory without imposing a size cap. The inactivity timer resets on each received chunk, allowing a malicious server to keep the loop alive indefinitely by sending small chunks just before the timeout expires and never sending a final frame. This leads to linear growth of the accumulation buffer, exhausting the BEAM process heap and causing an out-of-memory condition. It affects hackney versions from 2.0.0 up to but not including 4.0.1.

Exploitation of this vulnerability can cause a denial of service by exhausting the memory of the BEAM process running hackney, leading to out-of-memory crashes. This impacts availability of applications using the affected hackney versions when communicating with a malicious HTTP/3 server. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, users should consider avoiding communication with untrusted HTTP/3 servers or implementing external resource limits on the process running hackney to mitigate potential memory exhaustion.