Executive brief
Cowboy is a popular web server for the Erlang/Elixir ecosystem. A vulnerability in how it handles file uploads (multipart requests) allows an attacker to crash the server by sending specially crafted data that consumes all available system memory. This can lead to a complete service outage, though it does not directly expose sensitive customer data.
Technical details
A resource exhaustion vulnerability exists in cowboy_req:read_part/3 within src/cowboy_req.erl. The function fails to implement an upper-bound check when accumulating bytes into the request buffer during multipart header parsing. An unauthenticated remote attacker can exploit this by sending a multipart/form-data request that never provides a valid header terminator (\r\n\r\n) or boundary delimiter. This causes the server to recursively read and store data in memory without limit, eventually exhausting the BEAM virtual machine's memory. The issue is fixed in version 2.15.0 by introducing a 2048-byte limit on multipart header blocks.
Affected products
- ninenines cowboy >= 2.0.0, < 2.15.0
Timeline
- 2026-05-13: disclosed
- 2026-05-13: advisory
- 2026-05-13: patched: Fixed in version 2.15.0