# CVE-2026-65624: ninenines cowboy memory exhaustion via duplicate HTTP headers

Source: https://junglewise.ai/threats/cve-2026-65624-ninenines-cowboy-memory-exhaustion-via-duplicate-http-headers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-28. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2026-65624 · Severity: info · CVSS 6.9 · Published 2026-07-28

A vulnerability in the Cowboy HTTP server, a popular component for Erlang-based web applications, could allow an attacker to crash the service or exhaust server memory. By sending a specially crafted web request with many duplicate headers, an attacker can bypass security limits intended to prevent resource abuse. This can lead to a denial-of-service condition, impacting the availability of any applications relying on the affected server.

Technologies: [Nine Nines Cowboy](https://junglewise.ai/threats/technologies/cowboy). Vendors: [Nine Nines](https://junglewise.ai/threats/vendors/nine-nines).

## Quick answers

**Is CVE-2026-65624 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65624 being exploited in the wild.

**How severe is CVE-2026-65624?** Informational severity, with a CVSS score of 6.9, published 28 July 2026.

**Which products and versions are affected?** Nine Nines Cowboy 2.0.0-pre.4 before 2.18.0.

**Is there a fix for CVE-2026-65624?** A patch was published on 2026-07-22: Fix committed to GitHub repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-65624 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-65624?** Check whether you run Nine Nines Cowboy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The HTTP/1.1 handler in cowboy_http fails to properly enforce the max_headers limit because it counts distinct header names using a map (maps:size(Headers)). When multiple header lines share the same name, Cowboy concatenates their values into a single binary entry under one map key, preventing the header count from increasing. An unauthenticated remote attacker can exploit this by sending an arbitrary number of duplicate headers, leading to unbounded memory growth within the connection process. While the impact is somewhat mitigated by request timeouts and optional heap size limits, default configurations can lead to an out-of-memory (OOM) condition for the entire Erlang VM. The issue is fixed in version 2.18.0 by introducing a proper accumulator for the total number of header lines.

## Affected products

- ninenines cowboy 2.0.0-pre.4 before 2.18.0

## Timeline

- 2026-07-22: patched: Fix committed to GitHub repository
- 2026-07-28: disclosed: CVE published by Erlang Ecosystem Foundation CNA

## References

- [https://repo.hex.pm/](https://repo.hex.pm/)
- [https://github.com/](https://github.com/)
- [https://cna.erlef.org/cves/CVE-2026-65624.html](https://cna.erlef.org/cves/CVE-2026-65624.html)
- [https://github.com/ninenines/cowboy/commit/3a34d8c1cfd94326466aa16a9017236691dc9c55](https://github.com/ninenines/cowboy/commit/3a34d8c1cfd94326466aa16a9017236691dc9c55)

## Related threats

- [ninenines cowboy denial of service in multipart header parsing](https://junglewise.ai/threats/cve-2026-8466-ninenines-cowboy-denial-of-service-in-multipart-header-parsing)