8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-47067

CVE-2026-47067: Atom table exhaustion via unrecognized URL schemes in hackney

Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. The URL parser in src/hackney_url.erl converts every unrecognized URL scheme to a permanent BEAM atom via binary_to_atom/2. BEAM atoms are never garbage-collected and the atom table defaults to a hard limit of 1,048,576 entries. An attacker who can supply URLs with attacker-chosen scheme prefixes — directly as request targets, as configured webhook URLs, or via Location headers followed during redirects — can exhaust the atom table and crash the entire BEAM VM with system_limit.

This issue affects hackney: from 2.0.0 before 4.0.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-47067

CVE-2026-47067:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
hackney	erlang	>= 2.0.0, < 4.0.1	4.0.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the hackney_url:parse_url/1 function, which unconditionally converts the scheme part of a URL into an Erlang atom using binary_to_atom/2. Erlang has a hard limit on the number of atoms, and they are not garbage-collected. An attacker can exploit this by sending a large number of requests with unique URL schemes (e.g., uniq1://host, uniq2://host). Each unique scheme creates a new, permanent atom, eventually exhausting the atom table and causing the entire Erlang VM to crash, resulting in a denial of service. The hackney:request/5 function is a key entry point for this attack, as it accepts a raw URL string and passes it directly to the vulnerable parsing function. The patch commit 31f6f0e27e096ad88743dfded4f030a3ee74972e remediates this by replacing the unsafe binary_to_atom/2 call with binary_to_existing_atom/2, which ensures that only pre-existing atoms are used for known schemes, while unknown schemes are handled as binaries without creating new atoms.

Vulnerable functions

hackney_url:parse_url/1

src/hackney_url.erl

This function is responsible for parsing URLs. The vulnerability is in the line `SchemeAtom = binary_to_atom(SchemeLower, utf8)`, which converts any given URL scheme into an Erlang atom. Since atoms are not garbage-collected, an attacker can supply URLs with many unique, unrecognized schemes, which exhausts the atom table and crashes the BEAM virtual machine, leading to a denial of service.

hackney:request/5

src/hackney.erl

This is a primary API function for making requests. It takes a URL as a string and passes it to the vulnerable `hackney_url:parse_url/1` function for parsing. An attacker can call this function repeatedly with URLs containing unique schemes to trigger the atom table exhaustion vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.