The vulnerability in benoitc hackney arises from the URL parser in src/hackney_url.erl converting every unrecognized URL scheme into a permanent BEAM atom using binary_to_atom/2. Because BEAM atoms are never garbage-collected and the atom table has a hard limit of 1,048,576 entries, an attacker can supply URLs with arbitrary scheme prefixes (e.g., as request targets, webhook URLs, or redirect Location headers) to exhaust the atom table. This leads to a crash of the entire BEAM virtual machine due to system_limit. The issue affects hackney versions from 2.0.0 up to but not including 4.0.1.

Successful exploitation allows an unauthenticated attacker to cause a denial of service by crashing the BEAM VM hosting the hackney library. This is achieved by exhausting the atom table through uncontrolled creation of permanent atoms from attacker-supplied URL schemes. The impact is a high-severity denial of service affecting applications using vulnerable hackney versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is indicated in the provided data. Until a patch is available, avoid processing untrusted URLs with arbitrary schemes or limit exposure to attacker-controlled URL inputs to mitigate risk.