# hackney

Published articles for hackney.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## CVE-2026-97200 - Unbounded response body buffering and decompression in hackney

DevFeed: [CVE-2026-97200 - Unbounded response body buffering and decompression in hackney](<https://devfeed.tech/articles/cve-2026-97200-unbounded-response-body-buffering-and-decompression-in-hackney-100485.md>)

Original publisher: [Read original article](<https://cvefeed.io/vuln/detail/CVE-2026-97200>)

Author: cvefeed.io

Published: 2026-10-26T13:49:40Z

Content type: news

Language: en

Sources: [Latest High/Critical Vulnerabilitiy Feed](<https://devfeed.tech/sources/latest-high-critical-vulnerabilitiy-feed.md>)

Topics: [client](<https://devfeed.tech/topics/client.md>), [Streaming](<https://devfeed.tech/topics/streaming.md>), [IO](<https://devfeed.tech/topics/io.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [benoitc](<https://devfeed.tech/tags/benoitc.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-2026-97200](<https://devfeed.tech/tags/cve-2026-97200.md>), [hackney](<https://devfeed.tech/tags/hackney.md>), [http](<https://devfeed.tech/tags/http.md>), [http-2](<https://devfeed.tech/tags/http-2.md>), [http-3](<https://devfeed.tech/tags/http-3.md>), [http-server](<https://devfeed.tech/tags/http-server.md>), [limits](<https://devfeed.tech/tags/limits.md>), [malicious](<https://devfeed.tech/tags/malicious.md>), [memory](<https://devfeed.tech/tags/memory.md>), [process](<https://devfeed.tech/tags/process.md>), [request](<https://devfeed.tech/tags/request.md>), [server](<https://devfeed.tech/tags/server.md>), [trigger](<https://devfeed.tech/tags/trigger.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>), [with](<https://devfeed.tech/tags/with.md>), [zlib](<https://devfeed.tech/tags/zlib.md>)

### AI overview

CVE-2026-97200 allows a malicious HTTP server to exhaust hackney client memory with an oversized or highly compressed response. `hackney:request/5` and `hackney:body/1` return the entire body, while the connection process and HTTP/2 and HTTP/3 accumulators append chunks without a stated size limit. With `{auto_decompress, true}`, the buffered body is inflated all at once by `zlib:gunzip/1` or `zlib:inflate/2`. The reported affected range is hackney 2.0.0-beta.1 through versions before 4.9.0; the supplied text does not describe a fix or mitigation.

### Source excerpt

CVE ID :CVE-2026-97200 Published : Oct. 26, 2026, 1:49 p.m. | 14 minutes ago Description :Allocation of Resources Without Limits or Throttling vulnerability in hackney_conn in benoitc hackney allows a malicious HTTP server to exhaust client memory via an oversized or highly compressed response body. hackney:request/5 and hackney:body/1 return the whole response body, and nothing bounds how much the connection process buffers. Any server the client requests can trigger it. hackney_conn:read_full_body/2 and the HTTP/2 and HTTP/3 accumulators append every chunk until the body ends. With {auto_decompress, true} the buffered body is then inflated in one step with zlib:gunzip/1 or zlib:inflate/2, which return the whole output at once. This issue affects hackney: from 2.0.0-beta.1 before 4.9.0. Severity: 8.2 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

## CVE-2026-115693 - Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney

DevFeed: [CVE-2026-115693 - Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney](<https://devfeed.tech/articles/cve-2026-115693-custom-cacerts-or-cacertfile-do-not-restrict-trust-to-the-pinned-ca-in-hackney-100479.md>)

Original publisher: [Read original article](<https://cvefeed.io/vuln/detail/CVE-2026-115693>)

Author: cvefeed.io

Published: 2026-10-26T13:49:29Z

Content type: news

Language: en

Sources: [Latest High/Critical Vulnerabilitiy Feed](<https://devfeed.tech/sources/latest-high-critical-vulnerabilitiy-feed.md>)

Topics: [trust](<https://devfeed.tech/topics/trust.md>), [certificates](<https://devfeed.tech/topics/certificates.md>), [SSL](<https://devfeed.tech/topics/ssl.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [anchor](<https://devfeed.tech/tags/anchor.md>), [benoitc](<https://devfeed.tech/tags/benoitc.md>), [ca](<https://devfeed.tech/tags/ca.md>), [callback](<https://devfeed.tech/tags/callback.md>), [certificate](<https://devfeed.tech/tags/certificate.md>), [certificate-authority](<https://devfeed.tech/tags/certificate-authority.md>), [critical](<https://devfeed.tech/tags/critical.md>), [custom](<https://devfeed.tech/tags/custom.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-2026-115693](<https://devfeed.tech/tags/cve-2026-115693.md>), [hackney](<https://devfeed.tech/tags/hackney.md>), [otp](<https://devfeed.tech/tags/otp.md>), [pinned](<https://devfeed.tech/tags/pinned.md>), [ssl](<https://devfeed.tech/tags/ssl.md>), [store](<https://devfeed.tech/tags/store.md>), [trust](<https://devfeed.tech/tags/trust.md>), [validation](<https://devfeed.tech/tags/validation.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

### AI overview

In hackney versions 1.24.0 through before 4.9.0, setting `cacerts` or `cacertfile` did not reliably restrict TLS trust to a pinned private CA. hackney's `partial_chain` callback could select a certificate chaining to a bundled certifi root as the trust anchor, and OTP honored that callback over the configured trust store. As a result, an on-path attacker could impersonate a server pinned to a private CA if they had a publicly trusted certificate for the pinned hostname; hostname verification still applies.

### Source excerpt

CVE ID :CVE-2026-115693 Published : Oct. 26, 2026, 1:49 p.m. | 14 minutes ago Description :Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds {partial_chain, fun hackney_ssl:partial_chain/1} to every verify_peer configuration. The callback returns any certificate in the peer chain whose public key matches a root in the bundled certifi store as the trust anchor, and OTP honours that callback over the configured cacerts. hackney_ssl:merge_ssl_opts/3 kept the callback when the caller replaced the trust store with cacerts or cacertfile in ssl_options, so a connection pinned to a private CA still accepted any chain that carried a publicly trusted root. The hostname check still applies, so the attacker needs a publicly trusted certificate for the pinned hostname. This issue affects hackney: from 1.24.0 before 4.9.0. Severity: 9.1 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...