CVE-2026-47067 json
Atom table exhaustion via unrecognized URL schemes in hackney
published 2026-05-25 5 mo ago modified 2026-07-30 3 mo ago also EEF-CVE-2026-47067 , EUVD-2026-31691 , GHSA-9653-rcfr-5c62
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 55%
- public exploits
- 0
- none known
Summary
Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. The URL parser in src/hackney_url.erl converts every unrecognized URL scheme to a permanent BEAM atom via binary_to_atom/2. BEAM atoms are never garbage-collected and the atom table defaults to a hard limit of 1,048,576 entries. An attacker who can supply URLs with attacker-chosen scheme prefixes — directly as request targets, as configured webhook URLs, or via Location headers followed during redirects — can exhaust the atom table and crash the entire BEAM VM with system_limit.
This issue affects hackney: from 2.0.0 before 4.0.1.
Patch / fix
- hex hackney 4.0.1
- benoitc hackney 4.0.1
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 5 mo ago
Exploit prediction
0.75% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/benoitc/hackney/security/advisories/GHSA-9653-rcfr-5c62 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| hex | hackney | >=2.0.0, <4.0.1 |
4.0.1 |
Affected products
- benoitc hackney
Classification
- Weakness
-
- CWE-770 Allocation of Resources Without Limits or Throttling
References
-
github.com
/benoitc/hackney/commit/31f6f0e27e096ad88743dfded4f030a3ee74972e
patch, web
-
github.com
/benoitc/hackney/security/advisories/GHSA-9653-rcfr-5c62
vendor-advisory, related, exploit, web, patch, advisory
-
cna.erlef.org
/cves/CVE-2026-47067.html
related, web, patch, third-party-advisory
-
osv.dev
/vulnerability/EEF-CVE-2026-47067
related, web, patch, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-47067
advisory
-
github.com
/benoitc/hackney
package
-
hex.pm
/packages/hackney
package
Sources
- CVE List CVE-2026-47067
- GitHub Advisory GHSA-9653-rcfr-5c62
- NVD CVE-2026-47067
- OSV EEF-CVE-2026-47067
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.