CVE-2026-47067High▾ TwilightHackney vulnerable to atom-table exhaustion via unrecognized URL schemes
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.7%
0.7% → 0.8%
CVE-2026-47067 is an atom table exhaustion vulnerability (CWE-770) in hackney's URL parser (src/hackney_url.erl). hackney_url:parse_url/1 converts every URL scheme it encounters into a BEAM atom via binary_to_atom/2. Because BEAM atoms are never garbage-collected and the atom table has a hard limit of 1,048,576 entries, an attacker who can feed URLs with attacker-chosen scheme prefixes — directly as request targets, as webhook/callback URLs, or via Location headers in redirect chains — can exhaust the atom table and crash the entire BEAM VM with system_limit.
1. Scheme extraction and conversion
In src/hackney_url.erl, parse_url/1 extracts the scheme binary (the part before ://), validates it with is_valid_scheme/1 (RFC 3986 alphabet: alpha-led, <=19 bytes, alphanumeric/+/-/. body), lowercases it, then calls:
binary_to_atom(SchemeLower, utf8)
The resulting atom is stored on the #hackney_url{} record and returned to the caller.
2. Permanent atom accumulation
The validation constrains the alphabet but not uniqueness. The allowed scheme space is enormous (≈52·65¹⁸ values), far exceeding the default atom limit of 1,048,576. Each distinct scheme mints a new permanent atom. Even when hackney subsequently rejects an unsupported scheme with {error, {unsupported_scheme, _}}, the atom has already been interned and is never reclaimed.
3. Crash vector
The most dangerous path is redirect following: when hackney follows a Location header, the redirect target URL is re-parsed by the same function. An attacker-controlled server can serve a sequence of redirects — or a batch of URLs from an upstream feed — each with a fresh unique scheme, driving the atom count monotonically upward. At the limit the BEAM emits system_limit and the node terminates; recovery requires a full restart.
hackney_url:parse_url/1 (or :hackney.request/5) repeatedly with URLs whose scheme prefixes are unique on each call: aaaa://x, aaab://x, aaac://x, …erlang:system_info(:atom_count) climbing by one per unique scheme.system_limit.Alternatively, point hackney at a server that replies with a feed of ~1M URLs with distinct schemes (or uses redirect chains with rotating schemes); the atom table is exhausted and the node crashes without the client being able to intervene.
Unauthenticated remote denial of service via permanent resource exhaustion leading to VM termination. Any application using hackney 2.0.0 through 4.0.0 that processes attacker-influenced URLs — direct request targets, webhook URLs, or Location headers in followed redirects — is affected. No authentication or special configuration is required. CVSS v4.0 score: 8.7 (HIGH).
hackney >= 2.0.0, < 4.0.1Upgrade to a patched release:
hackney 4.0.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-47077HighHackney: Per-chunk timeout with unbounded body accumulation enables slow-drip OOM
CVE-2026-47066HighHackney has an infinite loop on non-token byte at start of an Alt-Svc entry
CVE-2026-47071HighHackney: `ssl:connect/2` post-handshake upgrade has no timeout
CVE-2026-47069LowHackney has CRLF / header injection via unvalidated `domain` and `path` options
CVE-2026-47076MediumHackney has SSRF allowlist bypass in hackney_url:normalize/2 via percent-encoded host
CVE-2026-47070MediumHackney: Cross-origin Redirect Leaks Authorization, Cookie, and Request Body