CVE-2026-47067

Katalog CVE

CVSS 7.5 · High EPSS 0,70%

Kerentanan Allocation of Resources Without Limits or Throttling pada benoitc hackney. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. The URL parser in src/hackney_url.erl converts every unrecognized URL scheme to a permanent BEAM atom via binary_to_atom/2. BEAM atoms are never garbage-collected and the atom table defaults to a hard limit of 1,048,576 entries. An attacker who can supply URLs with attacker-chosen scheme prefixes — directly as request targets, as configured webhook URLs, or via Location headers followed during redirects — can exhaust the atom table and crash the entire BEAM VM with system_limit. This issue affects hackney: from 2.0.0 before 4.0.1.

Rincian

Terbit di NVD

25 Mei 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,70% peluang dieksploitasi; lebih tinggi dari 51,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/benoitc/hackney/security/advisories/GHSA-9653-rcfr-5c62 exploit · patch · advisory vendor
• https://cna.erlef.org/cves/CVE-2026-47067.html patch · advisory pihak ketiga
• https://github.com/benoitc/hackney/commit/31f6f0e27e096ad88743dfded4f030a3ee74972e patch
• https://osv.dev/vulnerability/EEF-CVE-2026-47067 patch · advisory pihak ketiga