CVSS 7.5 · High EPSS 0,70%
Kerentanan Uncontrolled Resource Consumption pada benoitc hackney. Skor CVSS 3.1 7.5 (High) menurut NVD.
Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. hackney_h3:await_response_loop/6 accumulates the HTTP/3 response body in memory without any size cap. The after Timeout clause is a per-message inactivity timer that resets on every received chunk, housekeeping message, or settings frame — it is not a wall-clock deadline. A malicious HTTP/3 server that emits one small chunk every Timeout - 1 ms with Fin = false and never sends a final frame keeps the loop alive indefinitely while the accumulation buffer grows linearly without bound, eventually exhausting the BEAM process heap and causing an out-of-memory condition. This issue affects hackney: from 2.0.0 before 4.0.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| benoitc | hackney | Versi 2.0.0 hingga sebelum 4.0.1 |