PT-2026-40763 · Cowboy · Cowboy
CVSS v4.0
8.2
High
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
cowboy versions 2.0.0 through 2.14.x
Description
An issue in multipart header parsing allows an unauthenticated attacker to cause a denial of service via unbounded buffer accumulation. The function
read part() in src/cowboy req.erl accumulates incoming request bytes into a Buffer binary without an upper-bound check. When parse headers() returns more data, the function continues to read and recurse with an enlarged buffer. By sending a multipart/form-data request that never yields a complete header section—such as one missing the boundary delimiter or the `sequence—an attacker can force the server to accumulate memory linearly, potentially exhausting BEAM memory with a few concurrent uploads. This occurs when an HTTP endpoint callsread part/1,2` to process request bodies.Recommendations
Update to version 2.15.0 or later.
As a temporary workaround, restrict access to endpoints that process
multipart/form-data request bodies using the read part() function.Exploit
Fix
DoS
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cowboy