Resource Allocation Vulnerability in Hackney by Benoit C.
CVE-2026-47067

8.7HIGH

Key Information:

Vendor

Benoitc

Status
Hackney
Vendor
CVE Published:
25 May 2026

What is CVE-2026-47067?

The vulnerability in Hackney allows attackers to exploit the allocation of resources without throttling, leading to potential flooding attacks. By sending specially crafted URLs that utilize unrecognized scheme prefixes, an attacker can cause the URL parser to create permanent BEAM atoms. These atoms accumulate in the atom table, which is not garbage-collected and has a fixed limit. Consequently, if this limit is exceeded, it can result in the crash of the entire BEAM VM, affecting the stability of applications that depend on Hackney.

Affected Version(s)

hackney 2.0.0 < 4.0.1

hackney d9713695c0d99855d12c73fd8a0b4be0543950c4 < 31f6f0e27e096ad88743dfded4f030a3ee74972e

References

https://github.com/benoitc/hackney/security/advisories/GH...
vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-47067.html
related
https://osv.dev/vulnerability/EEF-CVE-2026-47067
related

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Peter Ullrich
Benoit Chesneau
Jonatan Männchen
.