Atom table exhaustion via unrecognized URL schemes in hackney_CVE-2026-47067

{
    "lastseen": "",
    "description": "Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. The URL parser in src/hackney_url.erl converts every unrecognized URL scheme to a permanent BEAM atom via binary_to_atom/2. BEAM atoms are never garbage-collected and the atom table defaults to a hard limit of 1,048,576 entries. An attacker who can supply URLs with attacker-chosen scheme prefixes \u2014 directly as request targets, as configured webhook URLs, or via Location headers followed during redirects \u2014 can exhaust the atom table and crash the entire BEAM VM with system_limit.\n\nThis issue affects hackney: from 2.0.0 before 4.0.1.",
    "published": "2026-05-25T14:00:48.507Z",
    "modified": "2026-05-25T14:00:48.507Z",
    "type": "cve",
    "title": "Atom table exhaustion via unrecognized URL schemes in hackney",
    "source": "EEF",
    "references": "https://github.com/benoitc/hackney/security/advisories/GHSA-9653-rcfr-5c62\nhttps://cna.erlef.org/cves/CVE-2026-47067.html\nhttps://osv.dev/vulnerability/EEF-CVE-2026-47067\nhttps://github.com/benoitc/hackney/commit/31f6f0e27e096ad88743dfded4f030a3ee74972e",
    "id": "CVE-2026-47067",
    "bulletinFamily": "",
    "cwe": [
        "CWE-770"
    ],
    "cvelist": null,
    "sourceData": "benoitc hackney 2.0.0\nbenoitc hackney d9713695c0d99855d12c73fd8a0b4be0543950c4",
    "sourceHref": "",
    "cvss": {
        "score": 8.7,
        "severity": "HIGH",
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "hackney",
    "version": "2.0.0",
    "vendor": "benoitc",
    "ai_description": "Atom table exhaustion via unrecognized URL schemes in hackney",
    "ai_severity": "High",
    "ai_vendor": "benoitc",
    "ai_product": "hackney",
    "ai_version": "2.0.0-4.0.0",
    "ai_score": 8.7
}