PT-2026-35422 · Unknown · Plug Cowboy

Peter Ullrich + 1 · Published 2026-04-27 · Updated 2026-05-22 · CVE-2026-32688

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions plug cowboy versions 2.0.0 through 2.8.0

Description An unauthenticated remote attacker can cause a denial of service via atom table exhaustion. In HTTP/2 connections, the Plug.Cowboy.Conn.conn/1 function in lib/plug/cowboy/conn.ex calls String.to atom/1 on the value returned by :cowboy req.scheme/1. Because cowlib passes the client-supplied :scheme pseudo-header value without validation, each unique value creates a permanent entry in the BEAM atom table. Since atoms are not garbage-collected and the table has a fixed limit, sending requests with unique :scheme values can exhaust the table, causing the Erlang VM to abort with a system limit and crashing the node. This issue does not affect HTTP/1.1.

Recommendations Update to version 2.8.1. As a temporary workaround, disable HTTP/2 on the Plug.Cowboy.https/3 listener by passing protocol options: %{protocols: [:http]} in the cowboy options to restrict the listener to HTTP/1.1.

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-32688

GHSA-Q8X4-X7MP-5VG2

Affected Products

Plug Cowboy

References · 14

• https://github.com/elixir-plug/plug_cowboy/commit/bfb34cb45eb354e56437f7023fb306de1bf9c19b · Patch
• https://github.com/elixir-plug/plug_cowboy/security/advisories/GHSA-q8x4-x7mp-5vg2 · Vendor Advisory
• https://osv.dev/vulnerability/EEF-CVE-2026-32688 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32688 · Security Note
• https://osv.dev/vulnerability/GHSA-q8x4-x7mp-5vg2 · Vendor Advisory
• https://github.com/elixir-plug/plug_cowboy · Note
• https://twitter.com/CVEnew/status/2048852163820957833 · Twitter Post
• https://twitter.com/dailycve/status/2051828581735469531 · Twitter Post
• https://cna.erlef.org/cves/CVE-2026-32688.html · Note
• https://hex.pm/packages/plug_cowboy · Note
• https://t.me/cveNotify/164563 · Telegram Post
• https://twitter.com/elixirforum/status/2048777298355032400 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2048873401075311043 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1t5dfkb/resumen_diario_de_vulnerabilidades_06052026 · Reddit Post