CVE-2026-115701

Cowboy HTTP/1.1 Unbounded Buffering of Pipelined Data During Request Handling Enables Memory Exhaustion

CVSS 4.0 8.2 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-115701

Published

Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1. Once a request has been received in full and its handler is still running, cowboy_http:parse/2 in src/cowboy_http.erl appends every further byte that arrives on the keep-alive connection to the connection buffer and returns to the receive loop without parsing it. The socket stays in active mode and no limit applies to this buffer: max_request_line_length, max_headers and the other parser limits only take effect once the handler returns and parsing resumes, and the only timer in this state is idle_timeout (default 60 seconds), which is reset on every received chunk. A client can therefore send an arbitrary amount of data on one connection for as long as the handler runs, and a few connections to an endpoint that holds requests open can drive the Erlang VM into out-of-memory conditions. This issue affects cowboy: from 2.18.0 before 2.21.0.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-115701

Published

cowboy

https://repo.hex.pm

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "collectionURL": "https://repo.hex.pm",
                    "cpes": [
                        "cpe:2.3:a:ninenines:cowboy:*:*:*:*:*:*:*:*"
                    ],
                    "defaultStatus": "unaffected",
                    "modules": [
                        "cowboy_http"
                    ],
                    "packageName": "cowboy",
                    "packageURL": "pkg:hex/cowboy",
                    "product": "cowboy",
                    "programFiles": [
                        "src/cowboy_http.erl"
                    ],
                    "programRoutines": [
                        {
                            "name": "cowboy_http:parse/2"
                        },
                        {
                            "name": "cowboy_http:loop/1"
                        }
                    ],
                    "repo": "https://github.com/ninenines/cowboy",
                    "vendor": "ninenines",
                    "versions": [
                        {
                            "lessThan": "2.21.0",
                            "status": "affected",
                            "version": "2.18.0",
                            "versionType": "semver"
                        }
                    ]
                }

ninenines/cowboy

https://github.com

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "collectionURL": "https://github.com",
                    "cpes": [
                        "cpe:2.3:a:ninenines:cowboy:*:*:*:*:*:*:*:*"
                    ],
                    "defaultStatus": "unaffected",
                    "modules": [
                        "cowboy_http"
                    ],
                    "packageName": "ninenines/cowboy",
                    "packageURL": "pkg:github/ninenines/cowboy",
                    "product": "cowboy",
                    "programFiles": [
                        "src/cowboy_http.erl"
                    ],
                    "programRoutines": [
                        {
                            "name": "cowboy_http:parse/2"
                        },
                        {
                            "name": "cowboy_http:loop/1"
                        }
                    ],
                    "repo": "https://github.com/ninenines/cowboy",
                    "vendor": "ninenines",
                    "versions": [
                        {
                            "lessThan": "3a630c07e1521abf63a1b9ea080509aa1337b60d",
                            "status": "affected",
                            "version": "faf5594fbf74530ace90b0c46c936bdc2cf82081",
                            "versionType": "git"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON