CVE-2026-8466

Name of the Vulnerable Software and Affected Versions cowboy versions 2.0.0 through 2.14.x

Description An issue in multipart header parsing allows an unauthenticated attacker to cause a denial of service via unbounded buffer accumulation. The function read part() in src/cowboy req.erl accumulates incoming request bytes into a Buffer binary without an upper-bound check. When parse headers() returns more data, the function continues to read and recurse with an enlarged buffer. By sending a multipart/form-data request that never yields a complete header section—such as one missing the boundary delimiter or the `

sequence—an attacker can force the server to accumulate memory linearly, potentially exhausting BEAM memory with a few concurrent uploads. This occurs when an HTTP endpoint callsread part/1,2` to process request bodies.

Recommendations Update to version 2.15.0 or later. As a temporary workaround, restrict access to endpoints that process multipart/form-data request bodies using the read part() function.