{"id":"GHSA-jfc2-q6qh-g5x8","summary":"Cowboy: Unbounded buffer accumulation in multipart header parsing causes denial of service in cowboy","details":"Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows denial of service via unbounded buffer accumulation in multipart header parsing.\n\ncowboy_req:read_part/3 in src/cowboy_req.erl accumulates incoming request bytes into a Buffer binary with no upper-bound check. When cow_multipart:parse_headers/2 returns more or {more, Buffer2}, the function reads up to Length bytes (default 64 KB) from the request body and recurses with the enlarged buffer. There is no equivalent of the byte_size(Acc) \u003e Length guard present in the sibling function read_part_body/4. An unauthenticated attacker can send a multipart/form-data request whose body never yields a complete header section — for example, a body that never contains the advertised boundary delimiter, or one whose header lines never contain \\r\\n\\r\\n — and force the server process to accumulate memory linearly with the bytes the protocol layer is willing to deliver. A handful of concurrent such uploads is sufficient to exhaust BEAM memory.\n\nThis issue affects cowboy from 2.0.0 before 2.15.0.","aliases":["CVE-2026-8466","EEF-CVE-2026-8466"],"modified":"2026-05-19T20:26:06.334145132Z","published":"2026-05-13T21:32:06Z","database_specific":{"nvd_published_at":"2026-05-13T19:17:30Z","cwe_ids":["CWE-770"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-05-19T20:12:33Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8466"},{"type":"WEB","url":"https://github.com/ninenines/cowboy/commit/5c6a2061b41bb5771c4659fac7d5a822dca5bafb"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-8466.html"},{"type":"PACKAGE","url":"https://github.com/ninenines/cowboy"},{"type":"WEB","url":"https://osv.dev/vulnerability/EEF-CVE-2026-8466"}],"affected":[{"package":{"name":"cowboy","ecosystem":"Hex","purl":"pkg:hex/cowboy"},"ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.15.0"}]}],"versions":["2.0.0","2.1.0","2.10.0","2.11.0","2.12.0","2.13.0","2.14.0","2.14.1","2.14.2","2.2.0","2.2.1","2.2.2","2.3.0","2.4.0","2.5.0","2.6.0","2.6.1","2.6.2","2.6.3","2.7.0","2.8.0","2.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-jfc2-q6qh-g5x8/GHSA-jfc2-q6qh-g5x8.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}