Read the docs
TI-2026-07435 Aliases CVE-2026-8466GHSA-jfc2-q6qh-g5x8

Unbounded buffer accumulation in multipart header parsing causes denial of service in cowboy

Priority LOW 36CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows denial of service via unbounded buffer accumulation in multipart header parsing. cowboy_req:read_part/3 in src/cowboy_req.erl accumulates incoming request bytes into a Buffer binary with no upper-bound check. When cow_multipart:parse_headers/2 returns more or {more, Buffer2}, the function reads up to Length bytes (default 64 KB) from the request body and recurses with the enlarged buffer. There is no equivalent of the byte_size(Acc) > Length guard present in the sibling function read_part_body/4. An unauthenticated attacker can send a multipart/form-data request whose body never yields a complete header section — for example, a body that never contains the advertised boundary delimiter, or one whose header lines never contain \r\n\r\n — and force the server process to accumulate memory linearly with the bytes the protocol layer is willing to deliver. A handful of concurrent such uploads is sufficient to exhaust BEAM memory. This issue affects cowboy from 2.0.0 before 2.15.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00382 32nd percentileScored 2026-11-07
Fix Fixed cowboy (ninenines): 2.15.0cowboy (Hex): 2.15.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nineninescowboy2.0.0 to before 2.15.02.15.0Patch availableCNA
—cowboy (Hex)2.0.0 to before 2.15.02.15.0Patch availableGHSA-jfc2-q6qh-g5x8
  • cowboy Vendorninenines Affected 2.0.0 to before 2.15.0 Fixed in 2.15.0 Patch available CNA
  • cowboy (Hex) Vendor— Affected 2.0.0 to before 2.15.0 Fixed in 2.15.0 Patch available GHSA-jfc2-q6qh-g5x8

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:ninenines:cowboy:*:*:*:*:*:*:*:*——ninenines
  • cpe:2.3:a:ninenines:cowboy:*:*:*:*:*:*:*:* Versions — — ·ninenines

Remediation

  • Fix · CNA cowboy (ninenines) Fixed in 2.15.0
  • Fix · GHSA-jfc2-q6qh-g5x8 cowboy (Hex) Fixed in 2.15.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-8466
  2. 2026-10-03 Alias added: GHSA-jfc2-q6qh-g5x8

References

Patch 1

Advisory 2

Other 2

  • TI-2026-32019 gun HTTP/1.1 client accepts unsolicited 101 Switching Protocols response allowing server-driven protocol hijack and OOM CVSS 4.0HIGH 8.7
  • TI-2026-32018 gun HTTP/1.1 response buffer has no size limit allowing server-controlled memory exhaustion CVSS 4.0HIGH 8.7
  • TI-2026-06860 Unbounded chunk-size hex digits in cowlib cause quadratic CPU and memory DoS CVSS 4.0HIGH 8.7
  • TI-2026-42388 Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS CVSS 4.0HIGH 8.7
  • TI-2026-85816 Unbounded HTTP/2 header list size in cowlib enables memory exhaustion CVSS 4.0HIGH 8.7
  • TI-2026-46781 Cowboy HTTP/1.1 max_headers Bypass via Duplicate Header Names Enables Memory Exhaustion CVSS 4.0MEDIUM 6.9
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences