Hackney's URL parser turns any unrecognized scheme into a permanent BEAM atom that persists for the life of the VM. Because the atom table has a hard limit, an attacker can supply many unique, custom schemes and eventually exhaust the table, causing the Erlang VM to terminate with a system_limit error. This results in a denial of service that crashes any application using the affected library. The vulnerability is a classic case of Uncontrolled Resource Consumption (CWE‑770).

The bug is present in the Hackney HTTP client library maintained by benoitc. It affects all releases from 2.0.0 up to but not including 4.0.1. Any Erlang or Elixir application that imports Hackney and accepts external URLs—as direct request targets, webhook callbacks, or redirect chains—could be impacted.

The CVSS score of 8.7 indicates critical severity. No EPSS value is currently available, and the issue is not listed in CISA KEV, but the attack path is straightforward: an attacker can inject a payload with many unique unknown schemes via direct URLs, webhooks, or redirect Location headers. Once the atom table limit is hit, the VM crashes, taking down the entire application. The risk is high for environments where Hackney handles untrusted input or relies on external redirects. Prompt remediation is recommended to prevent a production outage.