CVE-2026-32881: Vshakitskiy Ewe Auth Bypass Vulnerability

CVE-2026-32881 Overview

CVE-2026-32881 is an authentication bypass vulnerability affecting the ewe Gleam web server. The vulnerability exists in how ewe handles chunked transfer encoding trailers, where declared trailer fields are merged into req.headers after body parsing. The implementation's denylist only blocks 9 header names, allowing attackers to inject malicious headers by declaring them in the Trailer field and appending them after the final chunk.

This flaw enables request.set_header to overwrite legitimate header values, including those set by reverse proxies. Attackers can exploit this weakness to forge authentication credentials, hijack sessions, bypass IP-based rate limiting, or spoof proxy-trust headers in downstream middleware that reads headers after ewe.read_body is called.

Critical Impact

Attackers can bypass authentication mechanisms and spoof trusted proxy headers, potentially compromising session integrity and access controls in any application using affected versions of ewe.

Affected Products

• vshakitskiy ewe versions 0.6.0 through 3.0.4

Discovery Timeline

• 2026-03-20 - CVE-2026-32881 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-32881

Vulnerability Analysis

This vulnerability stems from CWE-183 (Permissive List of Allowed Inputs), where the ewe web server's trailer header handling employs an insufficient denylist approach. The chunked transfer encoding implementation merges trailer fields into request headers after body parsing completes, but the denylist only restricts 9 specific header names.

The attack surface is network-accessible and requires no authentication or user interaction. When a reverse proxy sets security-sensitive headers (such as X-Forwarded-For, authentication tokens, or session identifiers), an attacker can override these values by exploiting the trailer merging behavior. This is particularly dangerous in architectures where downstream middleware trusts headers set by upstream proxies.

Root Cause

The root cause lies in the permissive approach to trailer header validation. Instead of implementing an allowlist of permitted trailer headers, the original implementation used a limited denylist that failed to account for all security-sensitive headers. When ewe.read_body is called, the trailer fields declared by the client are merged into the request headers without adequate filtering, allowing header injection.

Attack Vector

An attacker can craft a malicious HTTP request using chunked transfer encoding with a Trailer header field declaring headers they wish to inject. After sending the request body in chunks and the final zero-length chunk, the attacker appends the spoofed headers as trailers. Because the denylist is incomplete, headers like Authorization, X-Forwarded-For, or custom authentication headers can be overwritten, bypassing security controls.

// Security patch in src/ewe/internal/http1.gleam - introduce allowlist for trailer headers

       case field_name {
         Ok(field_name) -> {
-          case
-            set.contains(set, field_name) && !is_forbidden_trailer(field_name)
-          {
+          case set.contains(set, field_name) && is_allowed_trailer(field_name) {
             True -> {
               case bit_array.to_string(value) {
                 Ok(value) -> {

Source: GitHub Commit

Detection Methods for CVE-2026-32881

Indicators of Compromise

• HTTP requests containing Trailer headers with security-sensitive field names (e.g., Authorization, X-Forwarded-For, X-Real-IP)
• Chunked transfer encoded requests with trailer sections containing authentication or session-related headers
• Log entries showing header value inconsistencies between reverse proxy logs and application logs

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests with suspicious Trailer header declarations
• Monitor for chunked transfer encoding requests that include trailer fields matching known sensitive header patterns
• Enable detailed logging at the reverse proxy layer to capture original header values for comparison with application-received headers

Monitoring Recommendations

• Configure alerting for requests containing Trailer headers with security-sensitive field names
• Implement header integrity validation by comparing reverse proxy-set headers with values received by the application
• Review access logs for patterns indicating authentication bypass attempts or unusual session behavior

How to Mitigate CVE-2026-32881

Immediate Actions Required

• Upgrade ewe to version 3.0.5 or later immediately
• Review application logs for signs of exploitation, particularly requests with trailer headers containing authentication data
• Audit downstream middleware that reads headers after ewe.read_body to assess potential exposure

Patch Information

The vulnerability has been fixed in ewe version 3.0.5. The fix transitions from a denylist approach to an allowlist approach for trailer headers, ensuring only explicitly permitted headers can be merged from trailers. The security patches are available in commits 07dcfd2 and 94ab6e7.

For detailed patch information, see the GitHub Security Advisory GHSA-9w88-79f8-m3vp and the v3.0.5 release.

Workarounds

• Deploy a reverse proxy or WAF rule to strip or reject requests containing Trailer headers with sensitive field names
• Implement application-level header validation to detect and reject requests where security headers may have been injected via trailers
• Consider disabling chunked transfer encoding at the reverse proxy layer if not required by your application

# Example: Block requests with suspicious Trailer headers at nginx level
# Add to nginx configuration
if ($http_trailer ~* "(authorization|x-forwarded|x-real-ip|cookie|set-cookie)") {
    return 400;
}