8.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-76v6-f83q-pxvh

GHSA-76v6-f83q-pxvh: Duplicate Advisory: Hackney has an Allocation of Resources Without Limits or Throttling vulnerabilit

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-jq4m-q6p2-8gwc. This link is maintained to preserve external references.

Original Description

Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. hackney_h3:await_response_loop/6 accumulates the HTTP/3 response body in memory without any size cap. The after Timeout clause is a per-message inactivity timer that resets on every received chunk, housekeeping message, or settings frame — it is not a wall-clock deadline. A malicious HTTP/3 server that emits one small chunk every Timeout - 1 ms with Fin = false and never sends a final frame keeps the loop alive indefinitely while the accumulation buffer grows linearly without bound, eventually exhausting the BEAM process heap and causing an out-of-memory condition.

This issue affects hackney: from 2.0.0 before 4.0.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-76v6-f83q-pxvh

GHSA-76v6-f83q-pxvh:

8.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
hackney	erlang	>= 2.0.0, < 4.0.1	4.0.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an uncontrolled resource consumption issue in the hackney library's handling of HTTP/3 responses. The core of the vulnerability is in the hackney_h3:await_response_loop/6 function. This function was responsible for receiving and buffering the response body. It used a per-chunk timeout and had no limit on the size of the buffered body. This allowed a malicious server to send a stream of small data chunks, continuously resetting the timeout and causing the application's memory usage to grow indefinitely, eventually leading to an out-of-memory error.

The patch addresses this by introducing two key changes:

Maximum Body Size: A max_body_size limit is introduced (defaulting to 512 MiB). The await_response_loop function now checks the size of the accumulated body after receiving each data chunk and returns an error if the limit is exceeded.
Absolute Timeout: The per-chunk timeout is replaced with an absolute wall-clock deadline for the entire response. This prevents a slow-drip attack from keeping the connection alive indefinitely.

The primary vulnerable function is hackney_h3:await_response_loop. The function hackney_h3:do_request is also identified as it directly calls the vulnerable function and is a necessary part of the call stack to trigger the vulnerability.

Vulnerable functions

hackney_h3:await_response_loop

src/hackney_h3.erl

The vulnerability lies in the `await_response_loop/6` function, which indefinitely accumulates the HTTP/3 response body in memory without any size limit. The timeout mechanism was a per-message inactivity timer that could be reset by a malicious server sending small chunks of data, leading to unbounded memory growth and a potential out-of-memory crash. The patch replaces this with a new implementation that enforces a maximum body size and uses a fixed wall-clock deadline.

hackney_h3:do_request

src/hackney_h3.erl

This function is part of the execution flow that leads to the vulnerability. It calls the vulnerable `await_response_loop` function. The patch modifies it to pass a `MaxBodySize` parameter to the new, patched version of `await_response_loop`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.