CVE-2026-47067

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-47067", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-05-18T17:28:08.321Z", "datePublished": "2026-05-25T14:00:48.507Z", "dateUpdated": "2026-05-27T15:41:27.821Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["hackney_url"], "packageName": "hackney", "packageURL": "pkg:hex/hackney", "product": "hackney", "programFiles": ["src/hackney_url.erl"], "programRoutines": [{"name": "hackney_url:parse_url/1"}], "repo": "https://github.com/benoitc/hackney", "vendor": "benoitc", "versions": [{"lessThan": "4.0.1", "status": "affected", "version": "2.0.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["hackney_url"], "packageName": "benoitc/hackney", "packageURL": "pkg:github/benoitc/hackney", "product": "hackney", "programFiles": ["src/hackney_url.erl"], "programRoutines": [{"name": "hackney_url:parse_url/1"}], "repo": "https://github.com/benoitc/hackney", "vendor": "benoitc", "versions": [{"lessThan": "31f6f0e27e096ad88743dfded4f030a3ee74972e", "status": "affected", "version": "d9713695c0d99855d12c73fd8a0b4be0543950c4", "versionType": "git"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*", "versionEndExcluding": "4.0.1", "versionStartIncluding": "2.0.0", "vulnerable": true}], "negate": false, "operator": "AND"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "finder", "value": "Peter Ullrich"}, {"lang": "en", "type": "remediation developer", "value": "Benoit Chesneau"}, {"lang": "en", "type": "analyst", "value": "Jonatan M\u00e4nnchen / EEF"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding.<p>The URL parser in <tt>src/hackney_url.erl</tt> converts every unrecognized URL scheme to a permanent BEAM atom via <tt>binary_to_atom/2</tt>. BEAM atoms are never garbage-collected and the atom table defaults to a hard limit of 1,048,576 entries. An attacker who can supply URLs with attacker-chosen scheme prefixes \u2014 directly as request targets, as configured webhook URLs, or via <tt>Location</tt> headers followed during redirects \u2014 can exhaust the atom table and crash the entire BEAM VM with <tt>system_limit</tt>.</p><p>This issue affects hackney: from 2.0.0 before 4.0.1.</p>"}], "value": "Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. The URL parser in src/hackney_url.erl converts every unrecognized URL scheme to a permanent BEAM atom via binary_to_atom/2. BEAM atoms are never garbage-collected and the atom table defaults to a hard limit of 1,048,576 entries. An attacker who can supply URLs with attacker-chosen scheme prefixes \u2014 directly as request targets, as configured webhook URLs, or via Location headers followed during redirects \u2014 can exhaust the atom table and crash the entire BEAM VM with system_limit.\n\nThis issue affects hackney: from 2.0.0 before 4.0.1."}], "impacts": [{"capecId": "CAPEC-125", "descriptions": [{"lang": "en", "value": "CAPEC-125 Flooding"}]}], "metrics": [{"cvssV4_0": {"attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-05-27T15:41:27.821Z"}, "references": [{"tags": ["vendor-advisory", "related"], "url": "https://github.com/benoitc/hackney/security/advisories/GHSA-9653-rcfr-5c62"}, {"tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-47067.html"}, {"tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-47067"}, {"tags": ["patch"], "url": "https://github.com/benoitc/hackney/commit/31f6f0e27e096ad88743dfded4f030a3ee74972e"}], "source": {"discovery": "EXTERNAL"}, "title": "Atom table exhaustion via unrecognized URL schemes in hackney", "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"references": [{"url": "https://github.com/benoitc/hackney/security/advisories/GHSA-9653-rcfr-5c62", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-26T15:45:32.232194Z", "id": "CVE-2026-47067", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-26T15:45:36.464Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-47067", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-26T15:45:32.232194Z"}}}], "references": [{"url": "https://github.com/benoitc/hackney/security/advisories/GHSA-9653-rcfr-5c62", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-26T15:45:07.470Z"}}], "cna": {"title": "Atom table exhaustion via unrecognized URL schemes in hackney", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Peter Ullrich"}, {"lang": "en", "type": "remediation developer", "value": "Benoit Chesneau"}, {"lang": "en", "type": "analyst", "value": "Jonatan M\u00e4nnchen"}], "impacts": [{"capecId": "CAPEC-125", "descriptions": [{"lang": "en", "value": "CAPEC-125 Flooding"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"], "repo": "https://github.com/benoitc/hackney", "vendor": "benoitc", "modules": ["hackney_url"], "product": "hackney", "versions": [{"status": "affected", "version": "2.0.0", "lessThan": "4.0.1", "versionType": "semver"}], "packageURL": "pkg:hex/hackney", "packageName": "hackney", "programFiles": ["src/hackney_url.erl"], "collectionURL": "https://repo.hex.pm", "defaultStatus": "unaffected", "programRoutines": [{"name": "hackney_url:parse_url/1"}]}, {"cpes": ["cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"], "repo": "https://github.com/benoitc/hackney", "vendor": "benoitc", "modules": ["hackney_url"], "product": "hackney", "versions": [{"status": "affected", "version": "d9713695c0d99855d12c73fd8a0b4be0543950c4", "lessThan": "31f6f0e27e096ad88743dfded4f030a3ee74972e", "versionType": "git"}], "packageURL": "pkg:github/benoitc/hackney", "packageName": "benoitc/hackney", "programFiles": ["src/hackney_url.erl"], "collectionURL": "https://github.com", "defaultStatus": "unaffected", "programRoutines": [{"name": "hackney_url:parse_url/1"}]}], "references": [{"url": "https://github.com/benoitc/hackney/security/advisories/GHSA-9653-rcfr-5c62", "tags": ["vendor-advisory", "related"]}, {"url": "https://cna.erlef.org/cves/CVE-2026-47067.html", "tags": ["related"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-47067", "tags": ["related"]}, {"url": "https://github.com/benoitc/hackney/commit/31f6f0e27e096ad88743dfded4f030a3ee74972e", "tags": ["patch"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. The URL parser in src/hackney_url.erl converts every unrecognized URL scheme to a permanent BEAM atom via binary_to_atom/2. BEAM atoms are never garbage-collected and the atom table defaults to a hard limit of 1,048,576 entries. An attacker who can supply URLs with attacker-chosen scheme prefixes \u2014 directly as request targets, as configured webhook URLs, or via Location headers followed during redirects \u2014 can exhaust the atom table and crash the entire BEAM VM with system_limit.\n\nThis issue affects hackney: from 2.0.0 before 4.0.1.", "supportingMedia": [{"type": "text/html", "value": "Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding.<p>The URL parser in <tt>src/hackney_url.erl</tt> converts every unrecognized URL scheme to a permanent BEAM atom via <tt>binary_to_atom/2</tt>. BEAM atoms are never garbage-collected and the atom table defaults to a hard limit of 1,048,576 entries. An attacker who can supply URLs with attacker-chosen scheme prefixes \u2014 directly as request targets, as configured webhook URLs, or via <tt>Location</tt> headers followed during redirects \u2014 can exhaust the atom table and crash the entire BEAM VM with <tt>system_limit</tt>.</p><p>This issue affects hackney: from 2.0.0 before 4.0.1.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.0.1", "versionStartIncluding": "2.0.0"}], "operator": "AND"}], "operator": "AND"}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-05-26T19:46:49.558Z"}}}, "cveMetadata": {"cveId": "CVE-2026-47067", "state": "PUBLISHED", "dateUpdated": "2026-05-26T19:46:49.558Z", "dateReserved": "2026-05-18T17:28:08.321Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-05-25T14:00:48.507Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["hackney_url"], "packageName": "hackney", "packageURL": "pkg:hex/hackney", "product": "hackney", "programFiles": ["src/hackney_url.erl"], "programRoutines": [{"name": "hackney_url:parse_url/1"}], "repo": "https://github.com/benoitc/hackney", "vendor": "benoitc", "versions": [{"lessThan": "4.0.1", "status": "affected", "version": "2.0.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["hackney_url"], "packageName": "benoitc/hackney", "packageURL": "pkg:github/benoitc/hackney", "product": "hackney", "programFiles": ["src/hackney_url.erl"], "programRoutines": [{"name": "hackney_url:parse_url/1"}], "repo": "https://github.com/benoitc/hackney", "vendor": "benoitc", "versions": [{"lessThan": "31f6f0e27e096ad88743dfded4f030a3ee74972e", "status": "affected", "version": "d9713695c0d99855d12c73fd8a0b4be0543950c4", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:benoitc:hackney:*:*:*:*:*:*:*:*", "matchCriteriaId": "B119C170-E9CA-4AEE-BE04-F074E70CBF82", "versionEndExcluding": "4.0.1", "versionStartIncluding": "2.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. The URL parser in src/hackney_url.erl converts every unrecognized URL scheme to a permanent BEAM atom via binary_to_atom/2. BEAM atoms are never garbage-collected and the atom table defaults to a hard limit of 1,048,576 entries. An attacker who can supply URLs with attacker-chosen scheme prefixes \u2014 directly as request targets, as configured webhook URLs, or via Location headers followed during redirects \u2014 can exhaust the atom table and crash the entire BEAM VM with system_limit.\n\nThis issue affects hackney: from 2.0.0 before 4.0.1."}, {"lang": "es", "value": "Vulnerabilidad de asignaci\u00f3n de recursos sin l\u00edmites ni limitaci\u00f3n de velocidad en benoitc hackney permite inundaci\u00f3n. El analizador de URL en src/hackney_url.erl convierte cada esquema de URL no reconocido en un \u00e1tomo BEAM permanente a trav\u00e9s de binary_to_atom/2. Los \u00e1tomos BEAM nunca se recolectan y la tabla de \u00e1tomos tiene por defecto un l\u00edmite estricto de 1.048.576 entradas. Un atacante que puede suministrar URL con prefijos de esquema elegidos por el atacante - directamente como objetivos de solicitud, como URL de webhook configuradas, o a trav\u00e9s de encabezados Location seguidos durante las redirecciones - puede agotar la tabla de \u00e1tomos y colapsar toda la VM BEAM con system_limit.\n\nEste problema afecta a hackney: desde 2.0.0 antes de 4.0.1."}], "id": "CVE-2026-47067", "lastModified": "2026-07-24T10:10:00.197", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47067", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-26T15:45:32.232194Z", "version": "2.0.3"}}]}, "published": "2026-05-25T15:16:21.740", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Patch", "Third Party Advisory"], "url": "https://cna.erlef.org/cves/CVE-2026-47067.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Patch"], "url": "https://github.com/benoitc/hackney/commit/31f6f0e27e096ad88743dfded4f030a3ee74972e"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "https://github.com/benoitc/hackney/security/advisories/GHSA-9653-rcfr-5c62"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Patch", "Third Party Advisory"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-47067"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "https://github.com/benoitc/hackney/security/advisories/GHSA-9653-rcfr-5c62"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0,4.0.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "hackney", "source": "cna", "vendor": "benoitc"}, "product": "hackney", "vendor": "benoitc"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d9713695c0d99855d12c73fd8a0b4be0543950c4,31f6f0e27e096ad88743dfded4f030a3ee74972e)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "hackney", "source": "cna", "vendor": "benoitc"}, "product": "hackney", "vendor": "benoitc"}], "created": "2026-05-25T16:00:14.104274+00:00", "updated": "2026-05-26T13:00:48.500147+00:00", "vendors": ["benoitc", "benoitc$PRODUCT$hackney"]}