← Back to CVE Explorer

CVE-2026-8466

Full vulnerability record from the local CVENow database.

Description

Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows denial of service via unbounded buffer accumulation in multipart header parsing. cowboy_req:read_part/3 in src/cowboy_req.erl accumulates incoming request bytes into a Buffer binary with no upper-bound check. When cow_multipart:parse_headers/2 returns more or {more, Buffer2}, the function reads up to Length bytes (default 64 KB) from the request body and recurses with the enlarged buffer. There is no equivalent of the byte_size(Acc) > Length guard present in the sibling function read_part_body/4. An unauthenticated attacker can send a multipart/form-data request whose body never yields a complete header section — for example, a body that never contains the advertised boundary delimiter, or one whose header lines never contain \r\n\r\n — and force the server process to accumulate memory linearly with the bytes the protocol layer is willing to deliver. A handful of concurrent such uploads is sufficient to exhaust BEAM memory. This issue affects cowboy from 2.0.0 before 2.15.0.

Severity
HIGH
CVSS score
8.2 (v4.0)
Vulnerability status
Deferred
Source identifier
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Published
2026-05-13 19:17:30.540000
Last modified
2026-10-26 14:10:00.130000
View original CVE JSON 
{
  "id": "CVE-2026-8466",
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "published": "2026-05-13T19:17:30.540",
  "lastModified": "2026-10-26T14:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows denial of service via unbounded buffer accumulation in multipart header parsing.\n\ncowboy_req:read_part/3 in src/cowboy_req.erl accumulates incoming request bytes into a Buffer binary with no upper-bound check. When cow_multipart:parse_headers/2 returns more or {more, Buffer2}, the function reads up to Length bytes (default 64 KB) from the request body and recurses with the enlarged buffer. There is no equivalent of the byte_size(Acc) > Length guard present in the sibling function read_part_body/4. An unauthenticated attacker can send a multipart/form-data request whose body never yields a complete header section — for example, a body that never contains the advertised boundary delimiter, or one whose header lines never contain \\r\\n\\r\\n — and force the server process to accumulate memory linearly with the bytes the protocol layer is willing to deliver. A handful of concurrent such uploads is sufficient to exhaust BEAM memory.\n\nThis issue affects cowboy from 2.0.0 before 2.15.0."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de asignación de recursos sin límites ni limitación en ninenines cowboy permite la denegación de servicio a través de la acumulación ilimitada de búfer en el análisis de encabezados multipart.\n\ncowboy_req:read_part/3 en src/cowboy_req.erl acumula bytes de solicitud entrantes en un binario de búfer sin una comprobación de límite superior. Cuando cow_multipart:parse_headers/2 devuelve more o {more, Buffer2}, la función lee hasta Length bytes (64 KB por defecto) del cuerpo de la solicitud y recurre con el búfer ampliado. No existe un equivalente de la guarda byte_size(Acc) > Length presente en la función hermana read_part_body/4. Un atacante no autenticado puede enviar una solicitud multipart/form-data cuyo cuerpo nunca produce una sección de encabezado completa - por ejemplo, un cuerpo que nunca contiene el delimitador de límite anunciado, o uno cuyas líneas de encabezado nunca contienen \\r\\n\\r\\n - y forzar al proceso del servidor a acumular memoria linealmente con los bytes que la capa del protocolo está dispuesta a entregar. Un puñado de dichas cargas concurrentes es suficiente para agotar la memoria BEAM.\n\nEste problema afecta a cowboy desde 2.0.0 antes de 2.15.0."
    }
  ],
  "affected": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "affectedData": [
        {
          "vendor": "ninenines",
          "product": "cowboy",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.hex.pm",
          "packageName": "cowboy",
          "cpes": [
            "cpe:2.3:a:ninenines:cowboy:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "cowboy_req"
          ],
          "programFiles": [
            "src/cowboy_req.erl"
          ],
          "programRoutines": [
            {
              "name": "cowboy_req:read_part/1"
            },
            {
              "name": "cowboy_req:read_part/2"
            },
            {
              "name": "cowboy_req:read_part/3"
            }
          ],
          "repo": "https://github.com/ninenines/cowboy",
          "packageURL": "pkg:hex/cowboy",
          "versions": [
            {
              "version": "2.0.0",
              "lessThan": "2.15.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "ninenines",
          "product": "cowboy",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com",
          "packageName": "ninenines/cowboy",
          "cpes": [
            "cpe:2.3:a:ninenines:cowboy:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "cowboy_req"
          ],
          "programFiles": [
            "src/cowboy_req.erl"
          ],
          "programRoutines": [
            {
              "name": "cowboy_req:read_part/1"
            },
            {
              "name": "cowboy_req:read_part/2"
            },
            {
              "name": "cowboy_req:read_part/3"
            }
          ],
          "repo": "https://github.com/ninenines/cowboy",
          "packageURL": "pkg:github/ninenines/cowboy",
          "versions": [
            {
              "version": "917cf99e10c41676183d501b86af6e47c95afb89",
              "lessThan": "5c6a2061b41bb5771c4659fac7d5a822dca5bafb",
              "versionType": "git",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-13T18:46:37.406887Z",
          "id": "CVE-2026-8466",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://cna.erlef.org/cves/CVE-2026-8466.html",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/ninenines/cowboy/commit/5c6a2061b41bb5771c4659fac7d5a822dca5bafb",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-8466",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    }
  ]
}