The flaw originates in hackney's HTTP/3 response handling, where the accumulated body is stored in a memory buffer without a size limit. A malicious server can send many tiny chunks with an indefinite lifetime, resetting the timeout on each fragment, while the loop continues. Over time the buffer grows linearly until the BEAM process heap is exhausted, causing an out‑of‑memory crash that terminates the client process and disrupts service availability.

The issue is present in the hackney Erlang client library for HTTP/3, affecting all releases from 2.0.0 up to, but not including, 4.0.1. Any application that imports hackney 2.0.0 through 4.0.0 is susceptible.

With a CVSS score of 8.2 the severity is high. The attack vector is remote; an attacker simply needs to host a malicious HTTP/3 server that sends a rapid stream of small chunks, keeping the client cycle alive. Because the loop depends on per‑message activity, the server can maintain control for as long as it wishes, eventually exhausting memory. No EPSS score is available and the vulnerability is not in CISA's KEV catalog, indicating it has not been widely exploited yet, but the potential impact remains significant.