Executive brief
A denial-of-service vulnerability exists in plug_cowboy, a library used to connect the Elixir Plug web interface with the Cowboy HTTP server. An unauthenticated remote attacker can crash the entire application server by sending specially crafted HTTP/2 requests that exhaust the system's memory for internal identifiers. This results in a complete service outage and requires a manual restart of the application.
Technical details
The vulnerability exists in Plug.Cowboy.Conn.conn/1 within lib/plug/cowboy/conn.ex, which calls String.to_atom/1 on the value returned by :cowboy_req.scheme/1. In HTTP/2 connections, the :scheme pseudo-header is client-supplied and passed without validation. Because Erlang atoms are not garbage-collected and the BEAM VM has a hard limit on the atom table (default 1,048,576), an attacker can send many unique :scheme values to trigger a 'system_limit' error, causing the entire node to abort. This issue does not affect HTTP/1.1 as the scheme is derived from the listener type. The vulnerability is fixed in version 2.8.1.
Affected products
- elixir-plug plug_cowboy >= 2.0.0, < 2.8.1
Timeline
- 2026-04-27: disclosed
- 2026-04-27: advisory
- 2026-04-27: patched