PT-2026-43065 · Hackney · Hackney

Benoit Chesneau + 2 · Published 2026-05-25 · Updated 2026-06-26 · CVE-2026-47067

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions hackney versions 2.0.0 through 4.0.0

Description An issue in the URL parser within src/hackney url.erl allows for resource exhaustion. The parser uses the binary to atom/2 function to convert unrecognized URL schemes into permanent BEAM atoms. Since BEAM atoms are not garbage-collected and the atom table has a hard limit of 1,048,576 entries, an attacker can exhaust this table by providing URLs with custom scheme prefixes. This can be achieved through request targets, configured webhook URLs, or Location headers during redirects, leading to a crash of the entire BEAM VM with a system limit error.

Recommendations Update to version 4.0.1.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-47067

GHSA-9653-RCFR-5C62

Affected Products

Hackney

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47067.json · Exploit
• 🔥 https://github.com/benoitc/hackney/security/advisories/GHSA-9653-rcfr-5c62 · Exploit
• https://github.com/benoitc/hackney/commit/31f6f0e27e096ad88743dfded4f030a3ee74972e · Patch
• https://cna.erlef.org/cves/CVE-2026-47067.html · Patch
• https://osv.dev/vulnerability/GHSA-9653-rcfr-5c62 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-47067 · Security Note
• https://osv.dev/vulnerability/CVE-2026-47067 · Vendor Advisory
• https://github.com/benoitc/hackney · Note
• https://github.com · Note
• https://osv.dev/vulnerability/EEF-CVE-2026-47067 · Vendor Advisory, Patch
• https://hex.pm/packages/hackney · Note
• https://repo.hex.pm · Note
• https://t.me/cveNotify/164838 · Telegram Post