Home
Home
Trends
Trends
Vulnerabilities
Vulnerabilities
News
News
Researchers
Researchers
Why dbugs?
Why dbugs?
Settings

Aaron Lovi

#48673of 60,594
6.3Total CVSS
Vulnerabilities · 1
PT-2026-146942
2026-11-13
6.3
CVE-2026-123635
Cowboy
Cowboy
A resource leak occurs in the `grpc stream h` function (`grpc server/src/grpc stream h.erl`) when the server refuses a call early, such as when the method is not implemented or the request body exceeds the `max body size` variable. In these cases, Cowboy drops DATA frames still in flight without returning their bytes to the connection flow-control window. Consequently, the connection window eventually empties, causing all subsequent calls on that shared HTTP/2 connection to stall and wait until their deadlines. This issue only affects the specific shared connection and does not impact other connections.