A lack of bounding on response body buffering in hackney allows a malicious HTTP server to send an oversized or highly compressed response. When the client receives such a response, it stores the entire body in memory before decompressing it with zlib. The combination of an unbounded buffer and a single‑pass decompression can consume an attacker‑designated amount of client memory, potentially crashing the client or causing a denial of service. The flaw is a classic example of CWE‑409 (Race Condition) and CWE‑770 (Out‑of‑Bounds Buffer Access).

The vulnerability affects the Elixir/Erlang HTTP client library hackney for vendors benoitc, covering versions from 2.0.0‑beta.1 up through, but not including, 4.9.0. The specific package is all of hackney’s HTTP request handling functions that read full bodies or stream content.

The CVSS score of 8.2 classifies this as a high‑severity flaw, and the absence of an EPSS score leaves the exact exploitation likelihood unknown, but the flaw is straightforward to trigger: an attacker simply acts as an HTTP server and sends a large or compressed response to any client using the vulnerable library. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread known exploitation, yet the attack vector is trivial for an attacker controlling a target endpoint. The recommended mitigation is to upgrade to a version that limits buffered data or otherwise applies throttling.