PT-2026-65436 · Ninenines · Cowboy
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
ninenines cowboy versions 2.0.0-pre.4 through 2.17.9
Description
An unauthenticated remote attacker can exhaust connection process memory over HTTP/1.1. The HTTP/1.1 handler in
cowboy http enforces the max headers limit by counting distinct header names. If a request contains multiple header lines with the same name, the values are concatenated into a single binary under one map key, preventing the max headers cap from being reached. Since there is no limit on the total number of header lines or the total byte size of the header block, an attacker can send numerous header lines with the same name to increase the binary memory of the connection process. If max heap size is not set, this can lead to out-of-memory conditions in the Erlang VM.Recommendations
Update ninenines cowboy to version 2.18.0 or later.
Set the
max heap size limit to prevent connection processes from consuming excessive memory.Fix
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cowboy