UBUNTU-CVE-2026-115701: High severity ubuntu/its vulnerability
Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1. Once a request has been received in full and its handler is still running, cowboyhttp:parse/2 in src/cowboyhttp.erl appends every further byte that arrives on the keep-alive connection to the connection buffer and returns to the receive loop without parsing it. The socket stays in active mode and no limit applies to this buffer: maxrequestlinelength, maxheaders and the other parser limits only take effect once the handler returns and parsing resumes, and the only timer in this state is idletimeout (default 60 seconds), which is reset on every received chunk. A client can therefore send an arbitrary amount of data on one connection for as long as the handler runs, and a few connections to an endpoint that holds requests open can drive the Erlang VM into out-of-memory conditions. This issue affects cowboy: from 2.18.0 onward.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An unauthenticated remote attacker needs to reach an HTTP/1.1 endpoint where a complete request can cause its handler to continue running. While that handler is running, the attacker can keep sending additional bytes on the same keep-alive connection to grow the connection buffer.
Are services using the default idle timeout protected?
No. The default idle_timeout is 60 seconds, but it is reset whenever another chunk is received. An attacker can therefore keep the connection alive by continuing to send data while the handler runs.
Which applications are most exposed to memory exhaustion?
Applications with endpoints that hold requests open are most exposed, because the vulnerable state persists for as long as the request handler is running. A few attacker-controlled connections to such an endpoint can drive the Erlang VM into out-of-memory conditions.
When do Cowboy parser limits apply?
Limits such as max_request_line_length and max_headers do not constrain data received while the handler is still running. They apply only after the handler returns and HTTP parsing resumes.