The hackney HTTP client library has an Allocation of Resources Without Limits or Throttling vulnerability (CWE-400) in the HTTP/3 response handling code. The function hackney_h3:await_response_loop/6 accumulates the response body in memory without a size cap. The timeout mechanism is a per-message inactivity timer that resets on each received chunk, not a fixed deadline. A malicious HTTP/3 server can exploit this by sending small chunks just before the timeout expires and never sending a final frame, causing the loop to remain active indefinitely. This results in linear growth of the accumulation buffer, eventually exhausting the BEAM process heap and causing an out-of-memory crash. The vulnerability affects hackney versions >=2.0.0 and <4.0.1.

Exploitation of this vulnerability can cause a denial of service by exhausting the memory of the BEAM process running hackney. This leads to out-of-memory conditions and potential application crashes or degraded service availability. There is no indication of privilege escalation or data disclosure from the provided information.

No official patch or fix is currently documented for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider limiting exposure to untrusted HTTP/3 servers or implementing external resource limits on BEAM processes to mitigate potential impact.