CVE-2026-65624
Received Received - Intake

Allocation of Resources Without Limits or Throttling in Cowboy

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: EEF

Description
Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1. The HTTP/1.1 handler in cowboy_http enforces the max_headers limit by counting the number of distinct header names in a map (maps:size(Headers)). When a request contains multiple header lines with the same name, the values are concatenated into a single ever-growing binary stored under that one map key (", " for regular headers, "; " for cookies), so the map size stays at one and the max_headers cap (default 100) is never reached. Because no accumulator bounds the total number of header lines or the total byte size of the header block (only per-line max_header_name_length and max_header_value_length apply), an unauthenticated client can send an arbitrary number of header lines with the same name and grow the connection process's binary memory to arbitrary size within the request window. The impact per connection is bounded by request_timeout (default 5 seconds, not reset by header data), and by max_heap_size when set (the offending connection process is killed once its heap grows past the limit). When max_heap_size is left at the default (unset), sustained abuse can drive the Erlang VM into out-of-memory conditions. This issue affects cowboy from 2.0.0-pre.4 before 2.18.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-65624
EUVD
EUVD-2026-49740

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ninenines cowboy From 2.0.0-pre.4 (inc) to 2.18.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Cowboy HTTP/1.1 server allows an unauthenticated remote attacker to exhaust the memory of a connection process by sending multiple HTTP headers with the same name. The issue occurs because Cowboy counts distinct header names to enforce the max_headers limit, but duplicate headers have their values concatenated into a single binary under one map key, bypassing the limit. This lets an attacker send an arbitrary number of headers, causing unbounded memory growth within the request timeout window.

Detection Guidance

Monitor for unusually high memory usage in Erlang VM processes associated with Cowboy. Check for processes exceeding max_heap_size limits or frequent timeouts. Inspect HTTP requests with excessive duplicate headers using network tools like tcpdump or Wireshark to capture and analyze header patterns.

Impact Analysis

An attacker could exploit this to cause a denial of service by consuming excessive memory on the server, potentially crashing the Erlang VM if max_heap_size is not set. This disrupts service availability for legitimate users and may lead to system instability.

Compliance Impact

This vulnerability primarily causes denial-of-service conditions by exhausting system memory, which could lead to service unavailability. While not directly violating GDPR or HIPAA, such disruptions may impact data processing integrity and availability requirements under these regulations. GDPR requires ensuring availability and resilience of processing systems, while HIPAA mandates safeguards against unauthorized access or disruptions. A successful exploit could compromise these compliance aspects by degrading system performance or causing outages.

Mitigation Strategies

Upgrade Cowboy to version 2.18.0 or later to apply the patch. Set max_heap_size in Erlang VM configuration to limit process memory growth. Configure firewalls or reverse proxies to block or rate-limit requests with excessive headers. Monitor for suspicious activity and restart affected services if memory thresholds are exceeded.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65624. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart