GHSA-gp9c-pm5m-5cxr

Suggest an improvement
Source
https://github.com/advisories/GHSA-gp9c-pm5m-5cxr
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-gp9c-pm5m-5cxr/GHSA-gp9c-pm5m-5cxr.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-gp9c-pm5m-5cxr
Aliases
Published
2026-06-26T21:53:50Z
Modified
2026-06-26T22:00:09Z
Severity
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Hackney: `ssl:connect/2` post-handshake upgrade has no timeout
Details

Summary

The SOCKS5 transport in src/hackney_socks5.erl correctly applies the caller-supplied timeout to the SOCKS5 negotiation phase, but then upgrades the tunnel to TLS using ssl:connect/2 (the two-argument form), which defaults to infinity. The Timeout value is in scope at that call site but is never forwarded. A hostile or man-in-the-middled SOCKS5 proxy that completes the SOCKS5 handshake normally and then stalls the TLS exchange will pin the connecting Erlang process and socket indefinitely, regardless of any connect_timeout or recv_timeout options the caller set.

Details

In src/hackney_socks5.erl, line 65, after the SOCKS5 negotiation succeeds, the code calls:

ssl:connect(Socket, SSLOpts)

The three-argument form ssl:connect/3 takes a timeout; the two-argument form used here defaults to infinity. The variable Timeout (already used for SOCKS5 recv calls earlier in the same function) is simply not passed. The bytes that drive the TLS handshake on the upstream side of the tunnel come from whatever endpoint the proxy connects to. A hostile proxy can complete SOCKS5 normally, then either stay silent or send a partial ServerHello and stop, keeping ssl:connect/2 blocked forever. No certificate forgery is needed.

PoC

  1. Stand up a SOCKS5 proxy that completes the SOCKS5 greeting and CONNECT reply normally, then goes silent (never sends a TLS ServerHello).
  2. Issue an HTTPS request through it via hackney with connect_timeout and recv_timeout set to a short value (e.g. 2000 ms).
  3. Observe the calling process remains blocked well past the configured timeout, consuming a process and socket until killed externally.

Impact

Denial of service via unbounded process and socket consumption. Affects hackney 0.10.0 through 4.0.0 for any HTTPS request routed through a SOCKS5 proxy. The connect_timeout and recv_timeout options give a false sense of safety since they are not honored during the TLS upgrade. CVSS v4.0: 8.2 (HIGH).

Resources

Database specific 
{
    "cwe_ids":  [
        "CWE-400"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-06-26T21:53:50Z",
    "nvd_published_at":  "2026-05-25T15:16:22Z",
    "severity":  "HIGH"
}
References

Affected packages

Hex / hackney

Package

Name
hackney
Purl
pkg:hex/hackney

Affected ranges

Type
SEMVER
Events
Introduced
0.10.0
Fixed
4.0.1

Affected versions

0.*
0.13.1
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.2
1.*
1.0.1
1.0.2
1.0.5
1.0.6
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.10
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.5.6
1.5.7
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.7.1
1.8.0
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.9.0
1.10.0
1.10.1
1.11.0
1.12.0
1.12.1
1.13.0
1.14.0
1.14.2
1.14.3
1.15.0
1.15.1
1.15.2
1.16.0
1.17.0
1.17.1
1.17.2
1.17.3
1.17.4
1.18.0
1.18.1
1.18.2
1.19.0
1.19.1
1.20.0
1.20.1
1.21.0
1.22.0
1.23.0
1.24.0
1.24.1
1.25.0
2.*
2.0.0-beta.1
2.0.0
2.0.1
3.*
3.0.0
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.2.0
3.2.1
4.*
4.0.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-gp9c-pm5m-5cxr/GHSA-gp9c-pm5m-5cxr.json"