Andrew Moore

An unauthenticated remote peer can cause memory exhaustion on an HTTP/2 endpoint. The issue occurs because the `cow http2 machine:headers decode/4` function in `src/cow http2 machine.erl` uses `cow hpack:decode/3` to decode HEADERS blocks without enforcing a limit on the size of the decoded header list, ignoring the `SETTINGS MAX HEADER LIST SIZE` defined in RFC 9113. An attacker can store a large header value (up to 4096 bytes) in the dynamic table and reference it multiple times using one-byte indexed fields. This allows a small amount of network traffic to expand into a large memory allocation. For example, a 110-byte block can decode into a header list of approximately 390 KB. When a consumer, such as Cowboy using `cowboy http2:headers to map/2`, joins repeated `cookie` fields into a single binary, it allocates this expanded size for every stream, potentially leading to the Erlang VM running out of memory.

Improper validation of certificates with host mismatches allows an adversary in the middle to impersonate a TLS peer using a certificate with a partial-label wildcard. The `try match wildcard/4` function in `src/ssl verify hostname.erl` only anchors text before and after the asterisk in identifiers like `f*.example.net`, allowing the wildcard to consume dots and accept certificates for unauthorized domains such as `f.evil.example.net`. This contradicts RFC 6125, which restricts wildcards to the left-most label. Additionally, the matcher allows `*.168.1.1` to match the IP literal `192.168.1.1`. This issue affects clients that disable Server Name Indication (SNI), servers verifying client certificate hostnames, and direct callers of the `verify cert hostname/2` function.

Cross-site Scripting (XSS) occurs when an attacker controls attribute names, allowing the injection of attributes and scripts into rendered HTML via the `Phoenix.HTML.attributes escape/1` function. The `key escape/1` function fails to properly neutralize whitespace in binary keys, enabling the creation of new attributes such as event handlers. Additionally, atom keys are only dasherized, allowing characters like quotes and angle brackets to pass through. This issue affects applications that build attribute keys from untrusted input and render them using HEEx `<tag {@attrs}>`, `content tag/3`, or direct calls. Nested `data`, `aria`, and `phx` keys are also susceptible. This can lead to the execution of arbitrary scripts in the browsers of users viewing the affected pages.