https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 15:47:23 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-322105 EUVD-2026-322105 https://cve.radiocsirt.org/vuln/euvd-2026-322105 https://cve.radiocsirt.org/vuln/fkie_cve-2026-47067 <p>Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. The URL parser in src/hackney_url.erl converts every unrecognized URL scheme to a permanent BEAM atom via binary_to_atom/2. BEAM atoms are never garbage-collected and the atom table defaults to a hard limit of 1,048,576 entries. An attacker who can supply URLs with attacker-chosen scheme prefixes — directly as request targets, as configured webhook URLs, or via Location headers followed during redirects — can exhaust the atom table and crash the entire BEAM VM with system_limit.</p> <p>This issue affects hackney: from 2.0.0 before 4.0.1.</p> <p>Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. The URL parser in src/hackney_url.erl converts every unrecognized URL scheme to a permanent BEAM atom via binary_to_atom/2. BEAM atoms are never garbage-collected and the atom table defaults to a hard limit of 1,048,576 entries. An attacker who can supply URLs with attacker-chosen scheme prefixes — directly as request targets, as configured webhook URLs, or via Location headers followed during redirects — can exhaust the atom table and crash the entire BEAM VM with system_limit.</p> <p>This issue affects hackney: from 2.0.0 before 4.0.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-47067 https://cve.radiocsirt.org/vuln/ghsa-9653-rcfr-5c62 <p><strong>Affected:</strong> Hex: hackney</p> <p>### Summary</p> <p>[CVE-2026-47067](https://nvd.nist.gov/vuln/detail/CVE-2026-47067) is an atom table exhaustion vulnerability (CWE-770) in hackney&#39;s URL parser (`src/hackney_url.erl`). `hackney_url:parse_url/1` converts every URL scheme it encounters into a BEAM atom via `binary_to_atom/2`. Because BEAM atoms are never garbage-collected and the atom table has a hard limit of 1,048,576 entries, an attacker who can feed URLs with attacker-chosen scheme prefixes — directly as request targets, as webhook/callback URLs, or via `Location` headers in redirect chains — can exhaust the atom table and crash the entire BEAM VM with `system_limit`.</p> <p>### Details</p> <p>**1. Scheme extraction and conversion**</p> <p>In `src/hackney_url.erl`, `parse_url/1` extracts the scheme binary (the part before `://`), validates it with `is_valid_scheme/1` (RFC 3986 alphabet: alpha-led, `&lt;=19` bytes, alphanumeric/`+`/`-`/`.` body), lowercases it, then calls:</p> <p>```erlang binary_to_atom(SchemeLower, utf8) ```</p> <p>The resulting atom is stored on the `#hackney_url{}` record and returned to the caller.</p> <p>**2. Permanent atom accumulation**</p> <p>The validation constrains the alphabet but not uniqueness. The allowed scheme space is enormous (≈52·65¹⁸ values), far exceeding the default atom limit of 1,048,576. Each distinct scheme mints a new permanent atom. Even when hackney subsequently rejects an unsupported scheme with `{error, {unsupported_scheme, _}}`, the atom has already been interned and is never reclaimed.</p> <p>**3. Crash vector*…</p> <p><strong>Affected:</strong> Hex: hackney</p> <p>### Summary</p> <p>[CVE-2026-47067](https://nvd.nist.gov/vuln/detail/CVE-2026-47067) is an atom table exhaustion vulnerability (CWE-770) in hackney&#39;s URL parser (`src/hackney_url.erl`). `hackney_url:parse_url/1` converts every URL scheme it encounters into a BEAM atom via `binary_to_atom/2`. Because BEAM atoms are never garbage-collected and the atom table has a hard limit of 1,048,576 entries, an attacker who can feed URLs with attacker-chosen scheme prefixes — directly as request targets, as webhook/callback URLs, or via `Location` headers in redirect chains — can exhaust the atom table and crash the entire BEAM VM with `system_limit`.</p> <p>### Details</p> <p>**1. Scheme extraction and conversion**</p> <p>In `src/hackney_url.erl`, `parse_url/1` extracts the scheme binary (the part before `://`), validates it with `is_valid_scheme/1` (RFC 3986 alphabet: alpha-led, `&lt;=19` bytes, alphanumeric/`+`/`-`/`.` body), lowercases it, then calls:</p> <p>```erlang binary_to_atom(SchemeLower, utf8) ```</p> <p>The resulting atom is stored on the `#hackney_url{}` record and returned to the caller.</p> <p>**2. Permanent atom accumulation**</p> <p>The validation constrains the alphabet but not uniqueness. The allowed scheme space is enormous (≈52·65¹⁸ values), far exceeding the default atom limit of 1,048,576. Each distinct scheme mints a new permanent atom. Even when hackney subsequently rejects an unsupported scheme with `{error, {unsupported_scheme, _}}`, the atom has already been interned and is never reclaimed.</p> <p>**3. Crash vector*…</p> https://cve.radiocsirt.org/vuln/ghsa-9653-rcfr-5c62