{"id":"CVE-2026-115701","kind":"vulnerability","aliases":["CVE-2026-115701"],"related":[],"title":"Cowboy: unbounded buffering during open requests lets remote clients exhaust memory","description":"Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1.\n\nOnce a request has been received in full and its handler is still running, cowboy_http:parse/2 in src/cowboy_http.erl appends every further byte that arrives on the keep-alive connection to the connection buffer and returns to the receive loop without parsing it. The socket stays in active mode and no limit applies to this buffer: max_request_line_length, max_headers and the other parser limits only take effect once the handler returns and parsing resumes, and the only timer in this state is idle_timeout (default 60 seconds), which is reset on every received chunk. A client can therefore send an arbitrary amount of data on one connection for as long as the handler runs, and a few connections to an endpoint that holds requests open can drive the Erlang VM into out-of-memory conditions.\n\nThis issue affects cowboy: from 2.18.0 onward.","summary":"While a request handler is still running, Cowboy keeps appending every byte a client sends on a keep-alive HTTP/1.1 connection to an unlimited buffer. A remote, unauthenticated attacker using a few connections can drive the Erlang VM into out-of-memory conditions.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"cowboy","fixed":[],"affected":">= 2.18.0","ecosystem":"hex"}],"ecosystems":[],"tags":["cowboy","elixir","erlang","http-server","package"],"not_affected_if":["cowboy-below-2.18.0","http2-only","short-handlers-only"],"how_to_check":"- Find cowboy in rebar.lock or mix.lock; versions 2.18.0 and later (including 2.19.0, which predates the fix) are affected unless built from a commit including 3a630c0\n- Versions up to 2.17.0 are not affected (they answer 414 immediately)\n- Exposure is highest where HTTP/1.1 handlers hold requests open (cowboy_loop long polling, stream_reply, slow backend calls); HTTP/2 is not affected","fix":"No fixed release named by the advisory. Fix is commit 3a630c07e1521abf63a1b9ea080509aa1337b60d (stops reading pipelined data while a request is in progress; re-sets socket to passive). Until a release containing it ships, pin to that commit or stay on cowboy 2.17.0 or earlier (not affected per advisory).","status":"open","published_at":"2026-11-06T11:17:05+00:00","first_seen_at":"2026-11-06T11:41:23+00:00","triaged_at":"2026-11-06T11:41:54+00:00","updated_at":"2026-11-06T11:43:40+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-06T11:41:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Cowboy: unbounded buffering during open requests lets remote clients exhaust memory","impact":"medium","summary":"While a request handler is still running, Cowboy keeps appending every byte a client sends on a keep-alive HTTP/1.1 connection to an unlimited buffer. A remote, unauthenticated attacker using a few connections can drive the Erlang VM into out-of-memory conditions.","audience":"developers","category":"package","nicknames":[],"who_cares":["cowboy","erlang","elixir","http-server"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote clients exhaust Erlang VM memory, causing denial of service","analyst_note":"Confirm the fixed cowboy version from the linked patch on github.com; the sources do not name it.","how_to_check":"- Check the cowboy version in the project's `rebar.lock` or `mix.lock`, or the release in use\n- Look for cowboy 2.18.0 or later in the dependency tree, which the advisory says is affected\n- Identify HTTP endpoints that hold requests open for a long time, since those are the exposure path","plain_action":"","needs_analyst":true,"not_affected_if":["cowboy-below-2.18.0","short-handlers-only"],"who_is_affected":"Applications built on cowboy from 2.18.0 onward that serve HTTP/1.1 keep-alive connections to endpoints whose handlers hold requests open for a long time are exposed. Services that only serve short requests, or that sit behind a proxy that limits request body buffering, are less exposed. The sources do not state which versions contain a fix beyond the patch links.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00076,"input_tokens":4485,"output_tokens":623,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed cowboy version from the linked patch on github.com; the sources do not name it.","search":"'-115701':14A,17A '-2026':13A,16A '2.18.0':239C '60':183C 'activ':142C 'affect':236C 'aliv':45B,123C 'alloc':71C 'allow':82C 'amount':199C 'append':35B,113C 'appli':147C 'arbitrari':198C 'arriv':118C 'attack':55B,86C 'buffer':3A,51B,128C,150C 'byte':37B,116C 'chunk':191C 'client':9A,39B,193C 'condit':70B,233C 'connect':47B,59B,89C,124C,127C,204C,215C 'cowboy':1A,18A,19B,33B,81C,108C,237C 'cve':12A,15A 'data':201C 'default':182C 'drive':61B,224C 'effect':164C 'elixir':20B 'endpoint':218C 'erlang':21B,63B,226C 'everi':36B,114C,189C 'exhaust':10A,88C 'full':101C 'handler':29B,104C,167C,210C 'header':156C 'hold':220C 'http':23B,109C 'http-server':22B 'http/1.1':46B,93C 'idl':180C 'issu':235C 'keep':34B,44B,122C 'keep-al':43B,121C 'length':154C 'let':7A 'limit':75C,146C,161C 'line':153C 'long':207C 'loop':134C 'max':151C,155C 'memori':11A,69B,91C,232C 'mode':143C 'ninenin':80C 'one':203C 'onward':240C 'open':5A,222C 'out-of-memori':66B,229C 'packag':25B 'pars':136C,170C 'parse/2':110C 'parser':160C 'process':90C 'receiv':99C,133C,190C 'remot':8A,53B,85C 'request':6A,28B,96C,152C,221C 'reset':187C 'resourc':73C 'resum':171C 'return':130C,168C 'run':32B,107C,211C 'second':184C 'send':40B,196C 'server':24B 'socket':139C 'src/cowboy_http.erl':112C 'state':178C 'stay':140C 'still':31B,106C 'take':163C 'therefor':195C 'throttl':77C 'timeout':181C 'timer':175C 'unauthent':54B,84C 'unbound':2A 'unlimit':50B 'use':56B 'vm':64B,227C 'vulner':78C 'without':74C,135C","nicknames":[],"mitigations":[],"who_affected":"Erlang and Elixir apps (including Phoenix via the cowboy adapter) running cowboy 2.18.0 or later and serving HTTP/1.1 directly to clients. Any endpoint is exposed for as long as its handler runs; long polling, streamed responses and slow backend calls give an attacker time to buffer memory. HTTP/2-only listeners and apps on cowboy 2.17.0 or earlier can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["cowboy"],"ptokens":["cowboy"],"labels":["cowboy","elixir","erlang","high","httpserver","package"],"campaign_type":null,"search_a":"'-115701':14A,17A '-2026':13A,16A 'buffer':3A 'client':9A 'cowboy':1A,18A 'cve':12A,15A 'exhaust':10A 'let':7A 'memori':11A 'open':5A 'remot':8A 'request':6A 'unbound':2A","search_b":"'aliv':45B 'append':35B 'attack':55B 'buffer':51B 'byte':37B 'client':39B 'condit':70B 'connect':47B,59B 'cowboy':19B,33B 'drive':61B 'elixir':20B 'erlang':21B,63B 'everi':36B 'handler':29B 'http':23B 'http-server':22B 'http/1.1':46B 'keep':34B,44B 'keep-al':43B 'memori':69B 'out-of-memori':66B 'packag':25B 'remot':53B 'request':28B 'run':32B 'send':40B 'server':24B 'still':31B 'unauthent':54B 'unlimit':50B 'use':56B 'vm':64B","search_c":"'2.18.0':239C '60':183C 'activ':142C 'affect':236C 'aliv':123C 'alloc':71C 'allow':82C 'amount':199C 'append':113C 'appli':147C 'arbitrari':198C 'arriv':118C 'attack':86C 'buffer':128C,150C 'byte':116C 'chunk':191C 'client':193C 'condit':233C 'connect':89C,124C,127C,204C,215C 'cowboy':81C,108C,237C 'data':201C 'default':182C 'drive':224C 'effect':164C 'endpoint':218C 'erlang':226C 'everi':114C,189C 'exhaust':88C 'full':101C 'handler':104C,167C,210C 'header':156C 'hold':220C 'http':109C 'http/1.1':93C 'idl':180C 'issu':235C 'keep':122C 'keep-al':121C 'length':154C 'limit':75C,146C,161C 'line':153C 'long':207C 'loop':134C 'max':151C,155C 'memori':91C,232C 'mode':143C 'ninenin':80C 'one':203C 'onward':240C 'open':222C 'out-of-memori':229C 'pars':136C,170C 'parse/2':110C 'parser':160C 'process':90C 'receiv':99C,133C,190C 'remot':85C 'request':96C,152C,221C 'reset':187C 'resourc':73C 'resum':171C 'return':130C,168C 'run':107C,211C 'second':184C 'send':196C 'socket':139C 'src/cowboy_http.erl':112C 'state':178C 'stay':140C 'still':106C 'take':163C 'therefor':195C 'throttl':77C 'timeout':181C 'timer':175C 'unauthent':84C 'vm':227C 'vulner':78C 'without':74C,135C","first_public_at":"2026-11-06T11:17:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115701","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115701","severity":null,"published_at":"2026-11-06T11:17:05+00:00","modified_at":"2026-11-06T11:17:05+00:00","first_seen_at":"2026-11-06T11:41:23+00:00","fetched_at":"2026-11-06T11:41:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115701:1886","url":"https://cna.erlef.org/cves/CVE-2026-115701.html","severity":null,"published_at":"2026-11-06T11:43:40+00:00","modified_at":"2026-11-06T11:43:40+00:00","first_seen_at":"2026-11-06T11:43:40+00:00","fetched_at":"2026-11-06T11:43:40+00:00","note":"Read EEF CNA advisory (primary, CNA for cowboy) + fix commit 3a630c0. Affected >=2.18.0 (bug from removal of concurrent pipelined processing); 2.16.1/2.17.0 answer 414. No released fixed version named: latest tag seen is 2.19.0 (Sep 8, before disclosure) and Hex lists >=2.18.0 with no upper bound, so 2.19.0 presumably still affected; unconfirmed. HTTP/2 not affected. No exploitation or public PoC link beyond advisory steps.","cites":["https://cna.erlef.org/cves/CVE-2026-115701.html","https://hex.pm/packages/cowboy/advisories"]}],"documents":[{"id":85881,"url":"https://github.com/ninenines/cowboy/commit/3a630c07e1521abf63a1b9ea080509aa1337b60d","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":85882,"url":"https://github.com/ninenines/cowboy/commit/faf5594fbf74530ace90b0c46c936bdc2cf82081","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":86054,"url":"https://cna.erlef.org/cves/CVE-2026-115701.html","title":"EEF CNA: CVE-2026-115701 Cowboy HTTP/1.1 unbounded buffering","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":86055,"url":"https://hex.pm/packages/cowboy/advisories","title":"Hex.pm security advisories for cowboy","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}