CVE-2026-8466: Cowboy Multipart DoS Vulnerability

CVE-2026-8466 Overview

CVE-2026-8466 is a denial-of-service vulnerability in the Erlang cowboy HTTP server library maintained by the ninenines project. The flaw resides in cowboy_req:read_part/3 within src/cowboy_req.erl, where multipart header parsing accumulates request bytes into a buffer without enforcing an upper bound. An unauthenticated remote attacker can submit a multipart/form-data request whose header section never terminates, causing the server process to grow memory linearly with delivered bytes. A small number of concurrent connections is sufficient to exhaust the BEAM virtual machine memory. The issue affects cowboy versions from 2.0.0 up to but not including 2.15.0 and is tracked as [CWE-770] (Allocation of Resources Without Limits or Throttling).

Critical Impact
Unauthenticated attackers can exhaust BEAM memory and crash Cowboy-based services using a handful of malformed multipart uploads.

Affected Products

ninenines cowboy >= 2.0.0
ninenines cowboy < 2.15.0
Erlang/OTP applications and Elixir frameworks (Phoenix, Plug.Cowboy) depending on affected cowboy versions

Discovery Timeline

2026-05-13 - CVE-2026-8466 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-8466

Vulnerability Analysis

The vulnerability stems from missing input length enforcement in Cowboy's streaming multipart parser. The function cowboy_req:read_part/3 repeatedly invokes cow_multipart:parse_headers/2 against an in-memory Buffer binary. When the parser returns more or {more, Buffer2}, indicating that additional bytes are required to complete the header section, read_part/3 reads up to Length bytes (default 64 KB) from the request body and recurses with the enlarged buffer.

The sibling function read_part_body/4 includes a byte_size(Acc) > Length guard that aborts when the accumulated body exceeds the configured limit. No equivalent guard exists in read_part/3. As a result, the buffer holding unparsed multipart headers can grow without bound for as long as the transport layer continues to deliver bytes.

Root Cause

The root cause is the absence of a maximum size check on the header accumulator in the multipart header read loop. Cowboy trusts that a well-formed client will produce the \r\n\r\n terminator or the advertised boundary delimiter within a reasonable window, but no enforcement mechanism caps the accumulator if the client never satisfies that condition.

Attack Vector

An unauthenticated attacker sends an HTTP request with Content-Type: multipart/form-data to any endpoint that calls cowboy_req:read_part/3 directly or indirectly through higher-level frameworks. The attacker constructs a body that either omits the advertised boundary delimiter or never emits the \r\n\r\n header terminator. The server keeps requesting more bytes and appending them to the in-process binary. With a handful of concurrent connections, each holding gigabytes of accumulated buffer, the BEAM scheduler runs out of memory and the node crashes.

The vulnerability mechanism is documented in the upstream fix at GitHub commit 5c6a2061 and the CNA advisory from the Erlang Ecosystem Foundation.

Detection Methods for CVE-2026-8466

Indicators of Compromise

Sustained growth in BEAM process memory (erlang:memory/0) correlated with active cowboy_http, cowboy_http2, or cowboy_stream_h processes handling multipart/form-data requests.
HTTP requests with Content-Type: multipart/form-data that maintain long-lived TCP connections without completing within typical upload time bounds.
Crashes or OOM-kills of Erlang/Elixir nodes shortly after spikes in concurrent multipart requests.

Detection Strategies

Inspect web access logs for clients that send multipart/form-data payloads of anomalous size or duration relative to legitimate upload patterns.
Instrument the BEAM with recon:proc_count(memory, 10) or telemetry to flag Cowboy request processes holding unusually large binaries.
Correlate reverse-proxy or load-balancer metrics on slow uploads with downstream Erlang node memory pressure.

Monitoring Recommendations

Enable per-process memory alerts in production Erlang/Elixir deployments and trigger on Cowboy worker processes exceeding several hundred megabytes.
Track cowboy version inventory across services and confirm whether each dependent application has upgraded to 2.15.0 or later.
Monitor request duration histograms for multipart endpoints and alert on requests that stall in the header-read phase.

How to Mitigate CVE-2026-8466

Immediate Actions Required

Upgrade cowboy to version 2.15.0 or later in all Erlang and Elixir applications, including transitive dependencies via Phoenix and Plug.Cowboy.
Audit mix.lock and rebar.lock files to identify pinned vulnerable versions and rebuild release artifacts after upgrading.
Place a reverse proxy or WAF in front of Cowboy services to enforce maximum request body size and request timeout limits.

Patch Information

The vulnerability is fixed in cowboy 2.15.0. The upstream patch adds a buffer size guard to read_part/3 mirroring the existing check in read_part_body/4. Review the corrective change at the ninenines/cowboy fix commit and the advisory record at OSV EEF-CVE-2026-8466.

Workarounds

If upgrading is not immediately feasible, configure a fronting reverse proxy (nginx, HAProxy, AWS ALB) to terminate multipart/form-data requests that exceed a strict body size or header-read timeout.
Restrict multipart endpoints to authenticated users where possible to reduce the unauthenticated attack surface.
Reduce the per-node Erlang process memory limit via +MMmcs and erl flags so that runaway multipart handlers are killed before destabilizing the entire node.

bash

# Update cowboy to a patched version in an Elixir project
mix deps.update cowboy
mix deps.get
mix deps.compile cowboy

# Verify the resolved version is >= 2.15.0
mix deps | grep cowboy