# CVE-2026-8466: ninenines cowboy denial of service in multipart header parsing

Source: https://junglewise.ai/threats/cve-2026-8466-ninenines-cowboy-denial-of-service-in-multipart-header-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-05-19  
License: CC BY 4.0 with a link back

CVE-2026-8466 · Severity: high · CVSS 8.2 · Published 2026-05-13

Cowboy is a popular web server for the Erlang/Elixir ecosystem. A vulnerability in how it handles file uploads (multipart requests) allows an attacker to crash the server by sending specially crafted data that consumes all available system memory. This can lead to a complete service outage, though it does not directly expose sensitive customer data.

Technologies: [Nine Nines Cowboy](https://junglewise.ai/threats/technologies/cowboy). Vendors: [Nine Nines](https://junglewise.ai/threats/vendors/nine-nines).

## Quick answers

**Is CVE-2026-8466 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8466 being exploited in the wild.

**How severe is CVE-2026-8466?** High severity, with a CVSS score of 8.2, published 13 May 2026.

**Which products and versions are affected?** Nine Nines Cowboy >= 2.0.0, < 2.15.0, 2.0.0 to 2.14.2.

**Is there a fix for CVE-2026-8466?** A patch was published on 2026-05-13: Fixed in version 2.15.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-8466 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-8466?** Check whether you run Nine Nines Cowboy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A resource exhaustion vulnerability exists in cowboy_req:read_part/3 within src/cowboy_req.erl. The function fails to implement an upper-bound check when accumulating bytes into the request buffer during multipart header parsing. An unauthenticated remote attacker can exploit this by sending a multipart/form-data request that never provides a valid header terminator (\r\n\r\n) or boundary delimiter. This causes the server to recursively read and store data in memory without limit, eventually exhausting the BEAM virtual machine's memory. The issue is fixed in version 2.15.0 by introducing a 2048-byte limit on multipart header blocks.

## Affected products

- ninenines cowboy >= 2.0.0, < 2.15.0

## Identifiers

- CVE-2026-8466
- GHSA-jfc2-q6qh-g5x8

## Timeline

- 2026-05-13: disclosed
- 2026-05-13: advisory
- 2026-05-13: patched: Fixed in version 2.15.0

## References

- [https://github.com/ninenines/cowboy/commit/5c6a2061b41bb5771c4659fac7d5a822dca5bafb](https://github.com/ninenines/cowboy/commit/5c6a2061b41bb5771c4659fac7d5a822dca5bafb)
- [https://cna.erlef.org/cves/CVE-2026-8466.html](https://cna.erlef.org/cves/CVE-2026-8466.html)

## Related threats

- [ninenines cowboy memory exhaustion via duplicate HTTP headers](https://junglewise.ai/threats/cve-2026-65624-ninenines-cowboy-memory-exhaustion-via-duplicate-http-headers)