← Vulnerability feed

Vulnerability record · CVE-2026-47067 · published 25 May 2026

CVE-2026-47067: Benoitc hackney allocation without limits vulnerability

Benoitc · Hackney

Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. The URL parser in src/hackney_url.erl converts every unrecognized URL scheme to a permanent BEAM atom via binary_to_atom/2. BEAM atoms are never garbage-collected and the atom table defaults to a hard limit of 1,048,576 entries. An attacker who can supply URLs with attacker-chosen scheme prefixes — directly as request targets, as configured webhook URLs, or via Location headers followed during redirects — can exhaust the atom table and crash the entire BEAM VM with system_limit. This issue affects hackney: from 2.0.0 before 4.0.1.

8.7 CVSS 4.0 High EPSS 0.70% · top 48.8% CWE-770 · Allocation without limits
8.7CVSS 4.0 base score
0.70%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
5References, 2 tagged exploit
24 Jul 2026Last modified by NVD

Description

Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. The URL parser in src/hackney_url.erl converts every unrecognized URL scheme to a permanent BEAM atom via binary_to_atom/2. BEAM atoms are never garbage-collected and the atom table defaults to a hard limit of 1,048,576 entries. An attacker who can supply URLs with attacker-chosen scheme prefixes — directly as request targets, as configured webhook URLs, or via Location headers followed during redirects — can exhaust the atom table and crash the entire BEAM VM with system_limit. This issue affects hackney: from 2.0.0 before 4.0.1.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://cna.erlef.org/cves/CVE-2026-47067.html PatchThird Party Advisory
https://github.com/benoitc/hackney/commit/31f6f0e27e096ad88743dfded4f030a3ee74972e Patch
https://github.com/benoitc/hackney/security/advisories/GHSA-9653-rcfr-5c62 ExploitPatchVendor Advisory
https://osv.dev/vulnerability/EEF-CVE-2026-47067 PatchThird Party Advisory
https://github.com/benoitc/hackney/security/advisories/GHSA-9653-rcfr-5c62 ExploitPatchVendor Advisory

Track CVE-2026-47067 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.7CVE-2026-47073Benoitc hackney uncontrolled resource consumption vulnerabilityAllocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. The WebSocket client in src/hackney_ws.erl imp…EPSS 0.82%8.7CVE-2026-47066Benoitc hackney vulnerabilityLoop with Unreachable Exit Condition ('Infinite Loop') vulnerability in benoitc hackney allows Excessive Allocation. The Alt-Svc response header pars…EPSS 0.70%8.2CVE-2026-47071Benoitc hackney uncontrolled resource consumption vulnerabilityUncontrolled Resource Consumption vulnerability in benoitc hackney allows Flooding. The SOCKS5 transport in src/hackney_socks5.erl correctly applies …EPSS 0.70%8.2CVE-2026-47077Benoitc hackney uncontrolled resource consumption vulnerabilityAllocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. hackney_h3:await_response_loop/6 accumulates t…EPSS 0.70%6.9CVE-2026-47072Benoitc hackney vulnerabilityImproper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in benoitc hackney allows HTTP Request/Response Splitting. The WebSocket u…EPSS 0.52%6.9CVE-2026-47076Benoitc hackney interpretation conflict vulnerabilityInterpretation Conflict vulnerability in benoitc hackney allows Server Side Request Forgery. hackney_url:normalize/2 URL-decodes the host component a…EPSS 0.16%6.8CVE-2026-47075Benoitc hackney vulnerabilityImproper Neutralization of CRLF Sequences vulnerability in benoitc hackney allows HTTP Request Splitting. hackney does not percent-encode carriage re…EPSS 0.42%6.0CVE-2026-47070Benoitc hackney open redirect vulnerabilitySensitive Data Exposure vulnerability in benoitc hackney allows Retrieve Embedded Sensitive Data. The HTTP/3 redirect handler in src/hackney_h3.erl p…EPSS 0.35%

Source: NIST National Vulnerability Database (record CVE-2026-47067), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.