CVE-2026-47067
published 2026-05-25CVE-2026-47067: Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. The URL parser in src/hackney_url.erl converts every…
PriorityP345high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.70%
49.3th percentile
Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. The URL parser in src/hackney_url.erl converts every unrecognized URL scheme to a permanent BEAM atom via binary_to_atom/2. BEAM atoms are never garbage-collected and the atom table defaults to a hard limit of 1,048,576 entries. An attacker who can supply URLs with attacker-chosen scheme prefixes — directly as request targets, as configured webhook URLs, or via Location headers followed during redirects — can exhaust the atom table and crash the entire BEAM VM with system_limit.
This issue affects hackney: from 2.0.0 before 4.0.1.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| benoitc | hackney | >= 2.0.0 < 4.0.1 | 4.0.1 |
| benoitc | hackney | >= 2.0.0 < 4.0.1 | 4.0.1 |
| benoitc | hackney | >= 2.0.0 < 4.0.1 | 4.0.1 |
| benoitc | hackney | >= d9713695c0d99855d12c73fd8a0b4be0543950c4 < 31f6f0e27e096ad88743dfded4f030a3ee74972e | 31f6f0e27e096ad88743dfded4f030a3ee74972e |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
cvelistv5v4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
ghsa7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Hackney vulnerable to atom-table exhaustion via unrecognized URL schemes
ghsa·2026-06-26·CVSS 7.5
CVE-2026-47067 [HIGH] CWE-770 Hackney vulnerable to atom-table exhaustion via unrecognized URL schemes
Hackney vulnerable to atom-table exhaustion via unrecognized URL schemes
### Summary
[CVE-2026-47067](https://nvd.nist.gov/vuln/detail/CVE-2026-47067) is an atom table exhaustion vulnerability (CWE-770) in hackney's URL parser (`src/hackney_url.erl`). `hackney_url:parse_url/1` converts every URL scheme it encounters into a BEAM atom via `binary_to_atom/2`. Because BEAM atoms are never garbage-collected and the atom table has a hard limit of 1,048,576 entries, an attacker who can feed URLs with attacker-chosen scheme prefixes — directly as request targets, as webhook/callback URLs, or via `Location` headers in redirect chains — can exhaust the atom table and crash the entire BEAM VM with `system_limit`.
### Details
**1. Scheme extraction and conversion**
In `src/hackney_url.erl`, `pars
VulDB
benoitc hackney up to 4.0.0 URL Parser src/hackney_url.erl allocation of resources (EUVD-2026-31691)
vuldb·2026-05-25
CVE-2026-47067 [LOW] benoitc hackney up to 4.0.0 URL Parser src/hackney_url.erl allocation of resources (EUVD-2026-31691)
A vulnerability categorized as problematic has been discovered in benoitc hackney up to 4.0.0. This impacts an unknown function of the file src/hackney_url.erl of the component URL Parser. Executing a manipulation can lead to allocation of resources.
This vulnerability is handled as CVE-2026-47067. The attack can be executed remotely. There is not any exploit available.
It is advisable to upgrade the affected component.
CVEList
Atom table exhaustion via unrecognized URL schemes in hackney
cvelistv5·2026-05-25·CVSS 8.7
CVE-2026-47067 [HIGH] CWE-770 Atom table exhaustion via unrecognized URL schemes in hackney
Atom table exhaustion via unrecognized URL schemes in hackney
Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. The URL parser in src/hackney_url.erl converts every unrecognized URL scheme to a permanent BEAM atom via binary_to_atom/2. BEAM atoms are never garbage-collected and the atom table defaults to a hard limit of 1,048,576 entries. An attacker who can supply URLs with attacker-chosen scheme prefixes — directly as request targets, as configured webhook URLs, or via Location headers followed during redirects — can exhaust the atom table and crash the entire BEAM VM with system_limit.
This issue affects hackney: from 2.0.0 before 4.0.1.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://cna.erlef.org/cves/CVE-2026-47067.htmlhttps://github.com/benoitc/hackney/commit/31f6f0e27e096ad88743dfded4f030a3ee74972ehttps://github.com/benoitc/hackney/security/advisories/GHSA-9653-rcfr-5c62https://osv.dev/vulnerability/EEF-CVE-2026-47067https://github.com/benoitc/hackney/security/advisories/GHSA-9653-rcfr-5c62
2026-05-25
Published