CVE-2026-8466: Unbounded buffer accumulation in multipart header parsing causes denial of service in cowboy

Severity: high (CVSS 8.2 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-13 · updated 2026-10-26
Weakness: CWE-770

Description

Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows denial of service via unbounded buffer accumulation in multipart header parsing. cowboy_req:read_part/3 in src/cowboy_req.erl accumulates incoming request bytes into a Buffer binary with no upper-bound check. When cow_multipart:parse_headers/2 returns more or {more, Buffer2}, the function reads up to Length bytes (default 64 KB) from the request body and recurses with the enlarged buffer. There is no equivalent of the byte_size(Acc) > Length guard present in the sibling function read_part_body/4. An unauthenticated attacker can send a multipart/form-data request whose body never yields a complete header section — for example, a body that never contains the advertised boundary delimiter, or one whose header lines never contain \r\n\r\n — and force the server process to accumulate memory linearly with the bytes the protocol layer is willing to deliver. A handful of concurrent such uploads is sufficient to exhaust BEAM memory. This issue affects cowboy from 2.0.0 before 2.15.0.

Affected products

ninenines cowboy: from 2.0.0 before 2.15.0 — fixed in 2.15.0

How to fix

Upgrade to a fixed version: ninenines cowboy 2.15.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-8466 or the next vulnerability affects your stack