CVE-2026-115701— Cowboy HTTP/1.1 Unbounded Buffering of Pipelined Data During Request Handling Enables Memory Exhaustion

Quick assessment

Affected

ninenines cowboy

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ninenines Cowboy 中存在“无限制或无节流机制的资源分配”漏洞，允许未认证的远程攻击者通过 HTTP/1.1 耗尽连接处理进程的内存。当请求已完整接收但其处理程序（handler）仍在运行时，位于中的函数会将持久连接（keep-alive）上随后到达的每一个字节追加到连接缓冲区中，并直接返回到接收循环，而不对这些字节进行解析。此时套接字仍处于激活模式，且该缓冲区不受任何限制：、及其他解析器限制仅在处理程序返回并恢复解析后才生效；在此状态下唯一的计时器是（默认 60 秒），且该计时器会在每次

CVSS 8.2 · High Updated Nov 06, 2026

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Cowboy HTTP/1.1 Unbounded Buffering of Pipelined Data During Request Handling Enables Memory Exhaustion

Source: CVE Program / CVE List V5

Vulnerability Description

Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1. Once a request has been received in full and its handler is still running, cowboy_http:parse/2 in src/cowboy_http.erl appends every further byte that arrives on the keep-alive connection to the connection buffer and returns to the receive loop without parsing it. The socket stays in active mode and no limit applies to this buffer: max_request_line_length, max_headers and the other parser limits only take effect once the handler returns and parsing resumes, and the only timer in this state is idle_timeout (default 60 seconds), which is reset on every received chunk. A client can therefore send an arbitrary amount of data on one connection for as long as the handler runs, and a few connections to an endpoint that holds requests open can drive the Erlang VM into out-of-memory conditions. This issue affects cowboy: from 2.18.0 onward.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

不加限制或调节的资源分配

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
ninenines	cowboy	2.18.0 ~ *	`cpe:2.3:a:ninenines:cowboy::::::::`
ninenines	cowboy	faf5594fbf74530ace90b0c46c936bdc2cf82081 ~ 3a630c07e1521abf63a1b9ea080509aa1337b60d	`cpe:2.3:a:ninenines:cowboy::::::::`

II. Public POCs for CVE-2026-115701

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-115701

请登录查看更多情报信息。

Other References for CVE-2026-115701 (4)

https://osv.dev/vulnerability/EEF-CVE-2026-115701 related
https://cna.erlef.org/cves/CVE-2026-115701.html related third-party-advisory
https://github.com/ninenines/cowboy/commit/3a630c07e1521abf63a1b9ea080509aa1337b60d patch
https://github.com/ninenines/cowboy/commit/faf5594fbf74530ace90b0c46c936bdc2cf82081 related

https://www.cve.org/CVERecord?id=CVE-2026-115701

IV. Related Vulnerabilities

Same product: cowboy

Same vendor: ninenines

Same weakness: CWE-770