The vulnerability in benoitc hackney involves the allocation of BEAM atoms without limits or throttling when parsing URLs. Specifically, the URL parser in src/hackney_url.erl uses binary_to_atom/2 to convert unrecognized URL schemes into permanent atoms. Because BEAM atoms are not garbage-collected and the atom table has a hard limit of 1,048,576 entries, an attacker can supply many distinct URL schemes to exhaust this table. This leads to a system_limit error and crashes the entire BEAM virtual machine. The affected versions are hackney from 2.0.0 up to but not including 4.0.1.

Successful exploitation allows an attacker to cause a denial of service by crashing the BEAM VM hosting the hackney library. This is achieved by exhausting the atom table through uncontrolled creation of permanent atoms from attacker-supplied URL schemes. The impact is a high-severity denial of service affecting applications using vulnerable hackney versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's announcements for updates. Until a fix is available, avoid processing untrusted URLs with attacker-controlled schemes or implement application-level throttling or validation to limit the variety of URL schemes processed.