Threats tagged 'ghsa-wpmp-4grc-56ph'

A vulnerability in the hackney_conn component of the benoitc hackney HTTP client allows a malicious HTTP server to exhaust client memory by sending an oversized or highly compressed response body. The client buffers the entire response without limits, and with auto decompression enabled, decompresses the entire body at once, leading to potential resource exhaustion. This affects hackney versions from 2.0.0-beta.1 up to but not including 4.9.0.