Is CVE-2026-8466 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8466 being exploited in the wild.

How severe is CVE-2026-8466?

High severity, with a CVSS score of 8.2, published 13 May 2026.

Which products and versions are affected?

Nine Nines Cowboy >= 2.0.0, < 2.15.0, 2.0.0 to 2.14.2.

Is there a fix for CVE-2026-8466?

A patch was published on 2026-05-13: Fixed in version 2.15.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-8466 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-8466?

Check whether you run Nine Nines Cowboy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8466: ninenines cowboy denial of service in multipart header parsing

Q: Is there a fix for CVE-2026-8466?

A patch was published on 2026-05-13: Fixed in version 2.15.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-8466 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-8466?

Check whether you run Nine Nines Cowboy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8466 · Severity: high · CVSS 8.2 · Published 2026-05-13

Cowboy is a popular web server for the Erlang/Elixir ecosystem. A vulnerability in how it handles file uploads (multipart requests) allows an attacker to crash the server by sending specially crafted data that consumes all available system memory. This can lead to a complete service outage, though it does not directly expose sensitive customer data.

Technologies: Nine Nines Cowboy. Vendors: Nine Nines.

Quick answers

Is CVE-2026-8466 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8466 being exploited in the wild.
How severe is CVE-2026-8466?: High severity, with a CVSS score of 8.2, published 13 May 2026.
Which products and versions are affected?: Nine Nines Cowboy >= 2.0.0, < 2.15.0, 2.0.0 to 2.14.2.
Is there a fix for CVE-2026-8466?: A patch was published on 2026-05-13: Fixed in version 2.15.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-8466 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-8466?: Check whether you run Nine Nines Cowboy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A resource exhaustion vulnerability exists in cowboy_req:read_part/3 within src/cowboy_req.erl. The function fails to implement an upper-bound check when accumulating bytes into the request buffer during multipart header parsing. An unauthenticated remote attacker can exploit this by sending a multipart/form-data request that never provides a valid header terminator (\r\n\r\n) or boundary delimiter. This causes the server to recursively read and store data in memory without limit, eventually exhausting the BEAM virtual machine's memory. The issue is fixed in version 2.15.0 by introducing a 2048-byte limit on multipart header blocks.

Affected products

ninenines cowboy >= 2.0.0, < 2.15.0

Identifiers

CVE-2026-8466
GHSA-jfc2-q6qh-g5x8

Timeline

2026-05-13: disclosed
2026-05-13: advisory
2026-05-13: patched: Fixed in version 2.15.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.