PatchSiren cyber security CVE debrief

CVE-2026-47073 benoitc CVE debrief

## Summary CVE-2026-47073 is a HIGH severity (CVSS 8.7) resource exhaustion vulnerability in the hackney Erlang HTTP client, specifically affecting its WebSocket implementation. The vulnerability allows a malicious WebSocket server to cause denial-of-service through memory exhaustion via three distinct attack vectors: unbounded handshake response buffering, unbounded frame payload buffering, and unbounded fragmented frame accumulation. The issue affects hackney versions from 2.0.0 through 4.0.0, with fixes available in version 4.0.1. No authentication or special client configuration is required for exploitation—only control of the server the hackney client connects to. ## Technical Details The vulnerability stems from three code paths in `src/hackney_ws.erl` that lack upper bounds on memory consumption: 1. **Handshake Response Buffer (`read_handshake_response/3`)**: Accumulates received bytes into a growing buffer without size limits. The per-receive timeout resets on every chunk received, allowing a server to stream bytes indefinitely without sending the required `CRLFCRLF` terminator, causing unbounded buffer growth until memory exhaustion. 2. **Frame Payload Parsing (`parse_payload/9` and `parse_active_payload/8`)**: Fails to validate declared payload lengths against any limit. RFC 6455 permits payload lengths up to 2^63-1 bytes; a server announcing a very large frame and dribbling bytes slowly causes the accumulation buffer to grow without bound until out-of-memory conditions occur. 3. **Fragmented Frame Buffer (`frag_buffer` field in `#ws_data{}`)**: Accumulates continuation frames indefinitely. A server sending an endless stream of non-final (no-FIN) fragmented frames without ever sending a final (FIN) frame causes `frag_buffer` to grow without bound. In all cases, the attacker only needs to control the WebSocket server that the hackney client connects to. No client-side authentication or special configuration is required. ## Affected Versions - **Affected**: hackney 2.0.0 through 4.0.0 (inclusive) - **Fixed**: hackney 4.0.1 and later ## Impact Assessment - **Availability Impact**: HIGH — Complete denial of service through memory exhaustion - **Conf/Integ/