The vulnerability is a lack of resource limits in the WebSocket client of the hackney library. The client can accumulate data without bounds during handshake, large frames, or fragmented frames, which leads to memory exhaustion and potential denial of service. The weakness is a resource allocation without limits, classified as CWE‑400. An attacker who controls the WebSocket server can trigger the bug by sending data without the normal terminators or by declaring enormous payloads, causing the client to consume memory until the process crashes or the system becomes unresponsive.

The hackney library, maintained by benoitc, is affected for all versions from 2.0.0 up to but excluding 4.0.1. Projects utilizing these versions and engaging in external WebSocket connections are at risk.

The CVSS score of 8.7 indicates high severity. No EPSS score is available, but resource‑limit exploitation is common and observable. The vulnerability is not listed in the CISA KEV catalog; nevertheless, because the attacker only needs to control the server, the attack vector is network‑based and does not require authentication or special privileges. If exploited, the client will run out of memory, terminate, and may deny service to the application depending on that connection.