EEF-CVE-2026-47071

See a problem?
Please try reporting it to the source first.

Source

https://cna.erlef.org/osv/EEF-CVE-2026-47071.html

Import Source

https://cna.erlef.org/osv/EEF-CVE-2026-47071.json

JSON Data

https://api.osv.dev/v1/vulns/EEF-CVE-2026-47071

Aliases

CVE-2026-47071
GHSA-gp9c-pm5m-5cxr

Published

2026-05-25T14:00:41.112Z

Modified

2026-05-25T14:26:25.846638504Z

Severity

8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

SOCKS5 TLS upgrade ignores caller timeout in hackney

Details

Summary

Uncontrolled Resource Consumption vulnerability in benoitc hackney allows Flooding. The SOCKS5 transport in src/hackneysocks5.erl correctly applies the caller-supplied timeout to the SOCKS5 negotiation phase, but then upgrades the connection to TLS using the two-argument form ssl:connect/2, which defaults to an infinite timeout. The Timeout value is in scope at the call site but is not forwarded. A hostile SOCKS5 proxy that completes the SOCKS5 handshake normally and then goes silent (or sends a partial TLS ServerHello and stalls) will cause the connecting process to block indefinitely, regardless of the connecttimeout or recv_timeout options supplied by the caller.

This issue affects hackney: from 0.10.0 before 4.0.1.

Database specific

{
    "cpe_ids": [
        "cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"
    ],
    "cwe_ids": [
        "CWE-400"
    ],
    "capec_ids": [
        "CAPEC-130"
    ]
}

References

Credits

- Peter Ullrich - FINDER
- Benoit Chesneau - REMEDIATION_DEVELOPER
- Jonatan Männchen - ANALYST

Affected packages

Hex / hackney

Package

Name: hackney
Purl: pkg:hex/hackney

Affected ranges

Type: SEMVER
Events: Introduced

0.10.0

Fixed

4.0.1

Affected versions

0.*

0.13.1

0.14.0

0.14.1

0.14.2

0.14.3

0.15.0

0.15.2

1.*

1.0.1

1.0.2

1.0.5

1.0.6

1.1.0

1.2.0

1.3.0

1.3.1

1.3.2

1.4.0

1.4.1

1.4.2

1.4.3

1.4.4

1.4.5

1.4.6

1.4.7

1.4.8

1.4.10

1.5.0

1.5.1

1.5.2

1.5.3

1.5.4

1.5.5

1.5.6

1.5.7

1.6.0

1.6.1

1.6.2

1.6.3

1.6.4

1.6.5

1.6.6

1.7.0

1.7.1

1.8.0

1.8.2

1.8.3

1.8.4

1.8.5

1.8.6

1.9.0

1.10.0

1.10.1

1.11.0

1.12.0

1.12.1

1.13.0

1.14.0

1.14.2

1.14.3

1.15.0

1.15.1

1.15.2

1.16.0

1.17.0

1.17.1

1.17.2

1.17.3

1.17.4

1.18.0

1.18.1

1.18.2

1.19.0

1.19.1

1.20.0

1.20.1

1.21.0

1.22.0

1.23.0

1.24.0

1.24.1

1.25.0

2.*

2.0.0-beta.1

2.0.0

2.0.1

3.*

3.0.0

3.0.1

3.0.2

3.0.3

3.1.0

3.1.1

3.1.2

3.2.0

3.2.1

4.*

4.0.0

Database specific

source

"https://cna.erlef.org/osv/EEF-CVE-2026-47071.json"

Git / github.com/benoitc/hackney