Executive brief
A vulnerability in the Cowboy HTTP server, a popular component for Erlang-based web applications, could allow an attacker to crash the service or exhaust server memory. By sending a specially crafted web request with many duplicate headers, an attacker can bypass security limits intended to prevent resource abuse. This can lead to a denial-of-service condition, impacting the availability of any applications relying on the affected server.
Technical details
The HTTP/1.1 handler in cowboy_http fails to properly enforce the max_headers limit because it counts distinct header names using a map (maps:size(Headers)). When multiple header lines share the same name, Cowboy concatenates their values into a single binary entry under one map key, preventing the header count from increasing. An unauthenticated remote attacker can exploit this by sending an arbitrary number of duplicate headers, leading to unbounded memory growth within the connection process. While the impact is somewhat mitigated by request timeouts and optional heap size limits, default configurations can lead to an out-of-memory (OOM) condition for the entire Erlang VM. The issue is fixed in version 2.18.0 by introducing a proper accumulator for the total number of header lines.
Affected products
- ninenines cowboy 2.0.0-pre.4 before 2.18.0
Timeline
- 2026-07-22: patched: Fix committed to GitHub repository
- 2026-07-28: disclosed: CVE published by Erlang Ecosystem Foundation CNA