CVE-2026-47071
HighSummary
Uncontrolled Resource Consumption vulnerability in the benoitc hackney library allows for Flooding attacks. The issue arises because after establishing a SOCKS5 connection, the timeout for the TLS connection is set to infinity by default, potentially leading to the blocking of the connecting process.
Risk Assessment
An attacker can exploit this vulnerability to block server resources, leading to denial of service. Organizations may experience significant disruptions in the operation of applications using this library.
Recommendation
It is recommended to update the hackney library to version 4.0.1 or later to mitigate this vulnerability. Additionally, consider implementing extra resource monitoring and limiting mechanisms.
Original NVD description (English source)
Uncontrolled Resource Consumption vulnerability in benoitc hackney allows Flooding. The SOCKS5 transport in src/hackney_socks5.erl correctly applies the caller-supplied timeout to the SOCKS5 negotiation phase, but then upgrades the connection to TLS using the two-argument form ssl:connect/2, which defaults to an infinite timeout. The Timeout value is in scope at the call site but is not forwarded. A hostile SOCKS5 proxy that completes the SOCKS5 handshake normally and then goes silent (or sends a partial TLS ServerHello and stalls) will cause the connecting process to block indefinitely, regardless of the connect_timeout or recv_timeout options supplied by the caller. This issue affects hackney: from 0.10.0 before 4.0.1.