Resource Exhaustion Vulnerability in elixir-plug's plug_cowboy Affects Unauthenticated Remote Access

CVE-2026-32688

What is CVE-2026-32688?

A resource exhaustion vulnerability in elixir-plug's plug_cowboy permits unauthenticated remote attackers to trigger a denial of service. This is achieved through atom table exhaustion as the plug_cowboy framework allows client-supplied :scheme pseudo-header values via HTTP/2 connections. Since unique atom entries are permanently allocated without limits, an attacker can overwhelm the fixed atom table size, ultimately causing the Erlang virtual machine to abort. This effectively brings down the entire node, disrupting services reliant on affected versions of plug_cowboy prior to 2.8.1.

References