{"id":"CVE-2026-8466","aliases":["EEF-CVE-2026-8466","GHSA-jfc2-q6qh-g5x8"],"url":"https://o3.security/vulnerability/CVE-2026-8466","summary":"Unbounded buffer accumulation in multipart header parsing causes denial of service in cowboy","details":"Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows denial of service via unbounded buffer accumulation in multipart header parsing.\n\ncowboy_req:read_part/3 in src/cowboy_req.erl accumulates incoming request bytes into a Buffer binary with no upper-bound check. When cow_multipart:parse_headers/2 returns more or {more, Buffer2}, the function reads up to Length bytes (default 64 KB) from the request body and recurses with the enlarged buffer. There is no equivalent of the byte_size(Acc) > Length guard present in the sibling function read_part_body/4. An unauthenticated attacker can send a multipart/form-data request whose body never yields a complete header section — for example, a body that never contains the advertised boundary delimiter, or one whose header lines never contain \\r\\n\\r\\n — and force the server process to accumulate memory linearly with the bytes the protocol layer is willing to deliver. A handful of concurrent such uploads is sufficient to exhaust BEAM memory.\n\nThis issue affects cowboy from 2.0.0 before 2.15.0.","published":"2026-05-13T18:26:21.089Z","modified":"2026-08-07T11:51:33.996253467Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Hex","name":"cowboy","fixedVersion":"2.15.0"}],"fix":{"url":"https://github.com/ninenines/cowboy/commit/5c6a2061b41bb5771c4659fac7d5a822dca5bafb","label":"ninenines/cowboy@5c6a206"},"references":[{"type":"WEB","url":"https://github.com"},{"type":"WEB","url":"https://osv.dev/vulnerability/EEF-CVE-2026-8466"},{"type":"WEB","url":"https://repo.hex.pm"},{"type":"ADVISORY","url":"https://cna.erlef.org/cves/CVE-2026-8466.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8466.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8466"},{"type":"FIX","url":"https://github.com/ninenines/cowboy/commit/5c6a2061b41bb5771c4659fac7d5a822dca5bafb"},{"type":"PACKAGE","url":"https://github.com/ninenines/cowboy"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-07T11:51:33.996253467Z"}}