CVE-2026-115701: Cowboy HTTP/1.1 Unbounded Buffering of Pipelined Data During Request Handling Enables Memory Exhaustion

Published Nov 6, 2026

Updated

Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1.

Once a request has been received in full and its handler is still running, cowboyhttp:parse/2 in src/cowboyhttp.erl appends every further byte that arrives on the keep-alive connection to the connection buffer and returns to the receive loop without parsing it. The socket stays in active mode and no limit applies to this buffer: maxrequestlinelength, maxheaders and the other parser limits only take effect once the handler returns and parsing resumes, and the only timer in this state is idletimeout (default 60 seconds), which is reset on every received chunk. A client can therefore send an arbitrary amount of data on one connection for as long as the handler runs, and a few connections to an endpoint that holds requests open can drive the Erlang VM into out-of-memory conditions.

This issue affects cowboy: from 2.18.0 onward.

Event History

Nov 6, 2026

CVE Published

via MITRE·10:29 AM

Data Sourced

via MITRE·10:29 AM

DescriptionWeakness

Frequently Asked Questions

Which deployments are most exposed to this issue?

Deployments using Cowboy 2.18.0 or later that accept HTTP/1.1 keep-alive connections and have endpoints whose handlers remain running for extended periods are most exposed. A small number of connections to such endpoints can exhaust Erlang VM memory.

What does an attacker need to do to trigger the memory exhaustion?

The attacker only needs unauthenticated remote HTTP/1.1 access. They send a complete request to an endpoint with a still-running handler, then continuously send additional data on the same keep-alive connection.

Do Cowboy parser size limits or the default idle timeout prevent exploitation?

No. Request-line and header limits are not applied while the handler is running, and the idle timeout defaults to 60 seconds but is reset whenever another chunk is received.

What can be done if patching cannot happen immediately?

Reduce exposure to long-running request handlers and restrict untrusted HTTP/1.1 keep-alive connections where possible. The supplied information does not identify a Cowboy configuration limit that caps the affected connection buffer during handler execution.

CVE-2026-115701: Cowboy HTTP/1.1 Unbounded Buffering of Pipelined Data During Request Handling Enables Memory Exhaustion

Event History

Frequently Asked Questions

Which deployments are most exposed to this issue?

What does an attacker need to do to trigger the memory exhaustion?

Do Cowboy parser size limits or the default idle timeout prevent exploitation?

What can be done if patching cannot happen immediately?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are most exposed to this issue?

What does an attacker need to do to trigger the memory exhaustion?

Do Cowboy parser size limits or the default idle timeout prevent exploitation?

What can be done if patching cannot happen immediately?