Denial of Service Vulnerability in Cowboy by ninenines

CVE-2026-8466

What is CVE-2026-8466?

A vulnerability in Cowboy allows for unbounded resource allocation during multipart header parsing. The 'read_part' function accumulates incoming request bytes without implementing a limit on buffer size, enabling an unauthenticated attacker to exploit this flaw. By sending specially crafted multipart/form-data requests that do not maintain proper header structure, the attacker can cause the server to continuously consume memory. This can result in denial of service when multiple concurrent requests are processed, potentially exhausting the server's resources and affecting availability. Affected versions range from 2.0.0 up to, but not including, 2.15.0, making immediate patching essential.

References