Home

Description

Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. The URL parser in src/hackney_url.erl converts every unrecognized URL scheme to a permanent BEAM atom via binary_to_atom/2. BEAM atoms are never garbage-collected and the atom table defaults to a hard limit of 1,048,576 entries. An attacker who can supply URLs with attacker-chosen scheme prefixes — directly as request targets, as configured webhook URLs, or via Location headers followed during redirects — can exhaust the atom table and crash the entire BEAM VM with system_limit. This issue affects hackney: from 2.0.0 before 4.0.1.

PUBLISHED Reserved 2026-05-18 | Published 2026-05-25 | Updated 2026-05-27 | Assigner EEF




HIGH: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-770 Allocation of Resources Without Limits or Throttling

Product status

Default status
unaffected

2.0.0 (semver) before 4.0.1
affected

Default status
unaffected

d9713695c0d99855d12c73fd8a0b4be0543950c4 (git) before 31f6f0e27e096ad88743dfded4f030a3ee74972e
affected

Credits

Peter Ullrich finder

Benoit Chesneau remediation developer

Jonatan Männchen / EEF analyst

References

github.com/...ackney/security/advisories/GHSA-9653-rcfr-5c62 exploit

github.com/...ackney/security/advisories/GHSA-9653-rcfr-5c62 vendor-advisory related

cna.erlef.org/cves/CVE-2026-47067.html related

osv.dev/vulnerability/EEF-CVE-2026-47067 related

github.com/...ommit/31f6f0e27e096ad88743dfded4f030a3ee74972e patch

cve.org (CVE-2026-47067)

nvd.nist.gov (CVE-2026-47067)

Download JSON