CVE-2026-65624: Cowboy HTTP/1.1 DoS Vulnerability

CVE-2026-65624 Overview

CVE-2026-65624 is an uncontrolled resource allocation vulnerability [CWE-770] in the ninenines/cowboy Erlang HTTP server. The flaw resides in the HTTP/1.1 handler cowboy_http, which enforces the max_headers limit by counting distinct header names in a map rather than counting total header lines or bytes. An unauthenticated remote attacker can send repeated header lines with the same name over a single HTTP/1.1 request. Cowboy concatenates the values into one growing binary, bypassing the default max_headers cap of 100 and inflating the connection process's binary memory. The issue affects cowboy from 2.0.0-pre.4 before 2.18.0.

Critical Impact
Sustained abuse can drive the Erlang VM into out-of-memory conditions when max_heap_size is left unset, resulting in denial of service across the host application.

Affected Products

ninenines cowboy 2.0.0-pre.4 through 2.17.x
Erlang/OTP applications embedding cowboy as their HTTP/1.1 server
Elixir and Phoenix deployments that ship cowboy as the underlying web server

Discovery Timeline

2026-07-28 - CVE-2026-65624 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-65624

Vulnerability Analysis

Cowboy's HTTP/1.1 parser stores request headers in an Erlang map keyed by header name. When a client sends the same header name multiple times, cowboy appends each new value to the existing map entry, using ", " as a separator for standard headers and "; " for Cookie. The number of map keys therefore remains at one regardless of how many duplicate header lines arrive on the wire.

The max_headers option (default 100) is evaluated using maps:size(Headers), so the header-count check never trips for repeated names. The parser also applies max_header_name_length and max_header_value_length per line, but no counter tracks the cumulative number of header lines or the total header block size. The connection process accumulates binary data on its heap until the request completes or a bounding limit intervenes.

Root Cause

The root cause is a counting error in the header-limit enforcement logic. Cowboy conflates unique header identity with header quantity, which makes the max_headers control ineffective against repeated header names. No aggregate accumulator bounds the total request header size, so per-line limits are the only remaining guardrails.

Attack Vector

An unauthenticated attacker opens a TCP connection to a cowboy-fronted HTTP/1.1 endpoint and streams an arbitrarily large number of header lines that share a single name, for example X-Filler: <padding> repeated thousands of times per request. Each duplicate line is folded into the same map entry, expanding the connection process's binary memory until request_timeout (default 5 seconds) fires or the process is killed by max_heap_size. When max_heap_size is unset, the Erlang VM itself can exhaust host memory. The attack requires no authentication, no user interaction, and only network reachability to the vulnerable listener.

No public proof-of-concept code is required to demonstrate this behavior; the exploitation primitive is a standard HTTP/1.1 request with repeated header lines. See the CNA advisory for CVE-2026-65624 and the upstream fix commit for parser-level details.

Detection Methods for CVE-2026-65624

Indicators of Compromise

HTTP/1.1 requests containing hundreds or thousands of header lines sharing a single header name against cowboy endpoints.
Sudden spikes in Erlang VM binary memory or beam.smp resident set size correlated with inbound HTTP traffic.
Repeated killed events for cowboy connection processes when max_heap_size is configured.
Elevated rates of request_timeout terminations without corresponding legitimate traffic growth.

Detection Strategies

Instrument HTTP proxies or load balancers to log and alert on requests where any header name appears more than a small threshold (for example, greater than 20 occurrences).
Monitor Erlang VM telemetry (erlang:memory/0, binary allocator stats) for abrupt growth tied to specific source IPs.
Correlate application logs showing dropped connections with network-layer captures of oversized header blocks.

Monitoring Recommendations

Ingest cowboy access and error logs into a centralized analytics platform to baseline normal header counts per request.
Alert on sustained inbound traffic from single sources holding long-lived HTTP/1.1 connections against cowboy listeners.
Track host-level memory pressure on beam.smp processes and alert before out-of-memory conditions terminate the VM.

How to Mitigate CVE-2026-65624

Immediate Actions Required

Upgrade cowboy to version 2.18.0 or later across all Erlang and Elixir services.
Set max_heap_size on cowboy connection processes so runaway processes are killed before exhausting the VM.
Reduce request_timeout from the default of 5 seconds where application semantics allow, to shrink the abuse window.
Place a reverse proxy such as nginx or HAProxy in front of cowboy and cap total request header size at a conservative value.

Patch Information

The fix ships in cowboy 2.18.0. The upstream change is available in the ninenines/cowboy commit 3a34d8c, which adjusts the HTTP/1.1 header parser to bound cumulative header data rather than relying solely on distinct header-name counts. See the OSV entry EEF-CVE-2026-65624 for ecosystem package advisories.

Workarounds

Terminate TLS and HTTP parsing at an upstream proxy that enforces total header-block size limits, for example nginx large_client_header_buffers and client_header_buffer_size.
Configure cowboy protocol options with an explicit max_heap_size on connection processes to bound per-connection memory growth.
Rate-limit connections per source IP at the network edge to slow header-flood attempts against long-lived HTTP/1.1 sessions.

bash

# Example nginx front-end limits to blunt duplicate-header floods
client_header_buffer_size 4k;
large_client_header_buffers 4 8k;
client_header_timeout 5s;
limit_conn_zone $binary_remote_addr zone=perip:10m;
limit_conn perip 20;