Loïc Hoguin

An unauthenticated remote peer can cause memory exhaustion on an HTTP/2 endpoint. The issue occurs because the `cow http2 machine:headers decode/4` function in `src/cow http2 machine.erl` uses `cow hpack:decode/3` to decode HEADERS blocks without enforcing a limit on the size of the decoded header list, ignoring the `SETTINGS MAX HEADER LIST SIZE` defined in RFC 9113. An attacker can store a large header value (up to 4096 bytes) in the dynamic table and reference it multiple times using one-byte indexed fields. This allows a small amount of network traffic to expand into a large memory allocation. For example, a 110-byte block can decode into a header list of approximately 390 KB. When a consumer, such as Cowboy using `cowboy http2:headers to map/2`, joins repeated `cookie` fields into a single binary, it allocates this expanded size for every stream, potentially leading to the Erlang VM running out of memory.

Improper encoding or escaping of output in the `cow link:link/1` function allows Link header directive smuggling. The `cow link:do link/1` function interpolates the target URI, `rel` value, and attribute keys directly into the serialized Link header without escaping or token-grammar validation. Specifically, a `>` byte in the target can prematurely close the URI slot, enabling the addition of unauthorized link entries. Additionally, a `"` or `` in the `rel` value can escape the quoted string to open new parameters, and any byte in an attribute key is emitted verbatim. This can force browsers to make out-of-band connections to attacker-controlled origins through directives such as `rel="preconnect"`, `rel="preload"`, and `rel="prerender"`.

An unauthenticated remote HTTP/2 or HTTP/3 peer can cause a denial of service by exhausting memory on a server or client. The issue exists in the HPACK and QPACK prefixed-integer decoder `cow hpack common:dec big int/3` (invoked from `cow hpack:decode/2` and `cow qpack:decode field section/3`), which fails to enforce limits on the number of continuation octets, the resulting bit width, or the final value. Because Erlang integers are immutable, each update allocates a new bignum, leading to transient memory allocation that grows quadratically relative to the encoded length. A single maximal HPACK indexed representation within HTTP/2 HEADERS and CONTINUATION frames can trigger hundreds of megabytes of allocation and garbage-collection churn, potentially leading to Erlang VM memory exhaustion when repeated or concurrent connections are used.

An unauthenticated remote attacker can exhaust connection process memory over HTTP/1.1. The HTTP/1.1 handler in `cowboy http` enforces the `max headers` limit by counting distinct header names. If a request contains multiple header lines with the same name, the values are concatenated into a single binary under one map key, preventing the `max headers` cap from being reached. Since there is no limit on the total number of header lines or the total byte size of the header block, an attacker can send numerous header lines with the same name to increase the binary memory of the connection process. If `max heap size` is not set, this can lead to out-of-memory conditions in the Erlang VM.

Improper neutralization of CRLF sequences in HTTP headers allows HTTP response splitting via non-VCHAR bytes in structured-fields string values. The function `escape string/2` in `cow http struct hd` only escapes backslashes and double quotes, passing other bytes verbatim. This creates an asymmetry where the parser accepts only printable ASCII, but the encoder emits any byte, including Carriage Return (CR) and Line Feed (LF). An application building a structured HTTP header via `item/1` in `cow http struct hd` (or wrappers like `wt protocol/1` in `cow http hd`) using attacker-controlled input can have CRLF sequences injected. These sequences terminate the current header, causing subsequent bytes to be interpreted as a new header.

Uncontrolled Resource Consumption in the `gun http` module allows a malicious server to exhaust client memory through unbounded HTTP/1.1 response buffering. In the `handle()/5` function, three clauses accumulate incoming TCP data into the connection's buffer using binary concatenation without an upper-bound check. Specifically, the head clause appends data until the header terminator is found, the `body chunked` clause appends data when `cow http te:stream chunked()/2` indicates an incomplete chunk boundary, and the `body trailer` clause appends data until the trailing terminator is found. If the expected terminator never arrives, the binary grows indefinitely in the state. A malicious server can exploit this by sending a partial response that never completes, leading to unbounded heap growth. Since BEAM does not impose per-process heap limits by default, a single connection can exhaust all available memory on the node, resulting in a node-wide out-of-memory crash.

An issue in the `gun http` module allows a malicious HTTP server to force a client into raw protocol mode by sending an unsolicited 101 Switching Protocols response. In the `handle inform/8` function, the software verifies the syntax of the Upgrade header and the stream reference but fails to check if the client actually requested an upgrade via Upgrade or Connection: upgrade headers. Consequently, any 101 response triggers a `gun upgrade` message and transitions the connection to raw protocol mode. In this mode, `gun raw` disables flow control and re-arms socket active mode after every packet, enabling a server to flood the client with arbitrary bytes. These are forwarded as unbounded `gun data` messages, which can exhaust the owner process mailbox and BEAM memory, leading to a virtual machine crash.

An origin validation error in the `gun http2` module allows cross-origin cookie injection through an unvalidated HTTP/2 PUSH PROMISE authority. In the `push promise frame()` function, the `:authority` pseudo-header from an incoming PUSH PROMISE frame is stored in the promised stream record without verifying that it matches the connection origin. Subsequently, the `headers frame()` function calls `set cookie header()` using this unvalidated authority. This behavior violates protocol standards that require receivers to treat pushes for resources the server is not authoritative for as protocol errors. A malicious or compromised HTTP/2 server can use this to plant cookies for arbitrary third-party domains in the client's shared cookie store, potentially leading to session fixation or account takeover. This is exploitable when the software is configured with a `cookie store` and connects to an HTTP/2 server with server push enabled.

Improper handling of highly compressed data leads to data amplification, allowing an unauthenticated remote actor to cause a denial of service via memory exhaustion. The `cow spdy:inflate/2` function passes compressed bytes from a peer to `zlib:inflate/2` without an output size bound. Because the SPDY header compression dictionary (`?ZDICT`) is public and zlib can compress repeated bytes at a ratio of approximately 1024:1, a small SPDY frame payload can decompress into gigabytes on the BEAM heap, resulting in an Out-Of-Memory (OOM) condition that kills the node. This condition can be triggered by a single unauthenticated SPDY frame. The `cow spdy:parse headers/2` function affects the parsers for `syn stream`, `syn reply`, and `headers` frame types. This issue specifically impacts applications that use `cow spdy:parse/2` to parse SPDY frames from untrusted peers.

An issue in multipart header parsing allows an unauthenticated attacker to cause a denial of service via unbounded buffer accumulation. The function `read part()` in `src/cowboy req.erl` accumulates incoming request bytes into a Buffer binary without an upper-bound check. When `parse headers()` returns more data, the function continues to read and recurse with an enlarged buffer. By sending a `multipart/form-data` request that never yields a complete header section—such as one missing the boundary delimiter or the ` ` sequence—an attacker can force the server to accumulate memory linearly, potentially exhausting BEAM memory with a few concurrent uploads. This occurs when an HTTP endpoint calls `read part/1,2` to process request bodies.

Improper Neutralization of CRLF Sequences (CRLF Injection) allows SSE event splitting and injection through unvalidated field values. The `cow sse:event/1` function guards the `id` and `event` fields against ` ` but not against `r`, while the internal `prefix lines/2` function used for data and comment fields only splits on ` `. Since the SSE specification treats `r `, `r`, and ` ` as equivalent line terminators, an attacker controlling these fields can inject additional SSE lines to forge events with arbitrary types and data payloads. In environments where browser EventSource clients or other SSE consumers render `event.data` or dispatch on `event.type`, this can lead to client-side logic manipulation and stored-XSS-equivalent behavior when data is inserted into the DOM.

An uncontrolled resource consumption issue in the `cow http te` module allows for excessive allocation. The chunked transfer-encoding parser accepts an unbounded number of hex digits in the chunk-size field. Each digit triggers a bignum multiplication, resulting in O(N²) CPU work and O(N) memory usage for N hex digits. When input is drip-fed, the parser discards accumulated length on partial reads and restarts, increasing the cost to O(N³). An unauthenticated remote attacker can cause a denial of service via CPU exhaustion and memory amplification by sending an HTTP/1.1 request with `Transfer-Encoding: chunked` and an excessively long chunk-size hex string. This issue is associated with the file `src/cow http te.erl` and the functions `cow http te:stream chunked/2` and `cow http te:chunked len/4`.

Improper Neutralization of CRLF Sequences (CRLF Injection) occurs when the `cow cookie:cookie/1` function builds a client-side Cookie request header from name-value pairs without validating the fields. An attacker controlling these names or values can inject characters such as ;, ,, CR, LF, or TAB into the serialized header. This allows for cookie smuggling, where phantom cookies are introduced to be treated as authentic by the receiving server, and HTTP request header splitting, which enables the appending of arbitrary headers or the smuggling of a second request against a shared upstream proxy.