CVE-2026-47071
published 2026-05-25CVE-2026-47071: Uncontrolled Resource Consumption vulnerability in benoitc hackney allows Flooding. The SOCKS5 transport in src/hackney_socks5.erl correctly applies the…
PriorityP345high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.70%
49.3th percentile
Uncontrolled Resource Consumption vulnerability in benoitc hackney allows Flooding. The SOCKS5 transport in src/hackney_socks5.erl correctly applies the caller-supplied timeout to the SOCKS5 negotiation phase, but then upgrades the connection to TLS using the two-argument form ssl:connect/2, which defaults to an infinite timeout. The Timeout value is in scope at the call site but is not forwarded. A hostile SOCKS5 proxy that completes the SOCKS5 handshake normally and then goes silent (or sends a partial TLS ServerHello and stalls) will cause the connecting process to block indefinitely, regardless of the connect_timeout or recv_timeout options supplied by the caller.
This issue affects hackney: from 0.10.0 before 4.0.1.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| benoitc | hackney | >= 0.10.0 < 4.0.1 | 4.0.1 |
| benoitc | hackney | >= 0.10.0 < 4.0.1 | 4.0.1 |
| benoitc | hackney | >= 0.10.0 < 4.0.1 | 4.0.1 |
| benoitc | hackney | >= 34cdbd1d20a282aacc286a89327465a3925b4c5d < 5ccdab725c561a6f03d05a51f2d0664f98236dae | 5ccdab725c561a6f03d05a51f2d0664f98236dae |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.08.2HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
cvelistv5v4.08.2HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Hackney: `ssl:connect/2` post-handshake upgrade has no timeout
ghsa·2026-06-26
CVE-2026-47071 [HIGH] CWE-400 Hackney: `ssl:connect/2` post-handshake upgrade has no timeout
Hackney: `ssl:connect/2` post-handshake upgrade has no timeout
### Summary
The SOCKS5 transport in `src/hackney_socks5.erl` correctly applies the caller-supplied timeout to the SOCKS5 negotiation phase, but then upgrades the tunnel to TLS using `ssl:connect/2` (the two-argument form), which defaults to `infinity`. The `Timeout` value is in scope at that call site but is never forwarded. A hostile or man-in-the-middled SOCKS5 proxy that completes the SOCKS5 handshake normally and then stalls the TLS exchange will pin the connecting Erlang process and socket indefinitely, regardless of any `connect_timeout` or `recv_timeout` options the caller set.
### Details
In `src/hackney_socks5.erl`, line 65, after the SOCKS5 negotiation succeeds, the code calls:
```erlang
ssl:connect(Socket, SSLOp
CVEList
SOCKS5 TLS upgrade ignores caller timeout in hackney
cvelistv5·2026-05-25·CVSS 8.2
CVE-2026-47071 [HIGH] CWE-400 SOCKS5 TLS upgrade ignores caller timeout in hackney
SOCKS5 TLS upgrade ignores caller timeout in hackney
Uncontrolled Resource Consumption vulnerability in benoitc hackney allows Flooding. The SOCKS5 transport in src/hackney_socks5.erl correctly applies the caller-supplied timeout to the SOCKS5 negotiation phase, but then upgrades the connection to TLS using the two-argument form ssl:connect/2, which defaults to an infinite timeout. The Timeout value is in scope at the call site but is not forwarded. A hostile SOCKS5 proxy that completes the SOCKS5 handshake normally and then goes silent (or sends a partial TLS ServerHello and stalls) will cause the connecting process to block indefinitely, regardless of the connect_timeout or recv_timeout options supplied by the caller.
This issue affects hackney: from 0.10.0 before 4.0.1.
VulDB
benoitc hackney up to 4.0.0 src/hackney_socks5.erl Timeout resource consumption (EUVD-2026-31685)
vuldb·2026-05-25
CVE-2026-47071 [LOW] benoitc hackney up to 4.0.0 src/hackney_socks5.erl Timeout resource consumption (EUVD-2026-31685)
A vulnerability has been found in benoitc hackney up to 4.0.0 and classified as problematic. The impacted element is an unknown function of the file src/hackney_socks5.erl. This manipulation of the argument Timeout causes resource consumption.
This vulnerability is registered as CVE-2026-47071. Remote exploitation of the attack is possible. No exploit is available.
The affected component should be upgraded.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://cna.erlef.org/cves/CVE-2026-47071.htmlhttps://github.com/benoitc/hackney/commit/5ccdab725c561a6f03d05a51f2d0664f98236daehttps://github.com/benoitc/hackney/security/advisories/GHSA-gp9c-pm5m-5cxrhttps://osv.dev/vulnerability/EEF-CVE-2026-47071https://github.com/benoitc/hackney/security/advisories/GHSA-gp9c-pm5m-5cxr
2026-05-25
Published