CVE-2026-32873— ewe: Loop with Unreachable Exit Condition ('Infinite Loop')
Quick assessment
Affected
vshakitskiy ewe
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
ewe是Vladislav Shakitskiy个人开发者的一个轻量级Web服务器构建包。 ewe 3.0.4及之前版本存在安全漏洞，该漏洞源于handle_trailers函数存在无限循环，可能导致拒绝服务。
Possible ATT&CK Techniques 2 AI
T1499 · Endpoint Denial of Service T1499.002 · Service Exhaustion Flood
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-32873
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ewe: Loop with Unreachable Exit Condition ('Infinite Loop')
Source: CVE Program / CVE List V5
Vulnerability Description
ewe is a Gleam web server. Versions 0.8.0 through 3.0.4 contain a bug in the handle_trailers function where rejected trailer headers (forbidden or undeclared) cause an infinite loop. When handle_trailers encounters such a trailer, three code paths (lines 520, 523, 526) recurse with the original buffer (rest) instead of advancing past the rejected header (Buffer(header_rest, 0)), causing decoder.decode_packet to re-parse the same header on every iteration. The resulting loop has no timeout or escape — the BEAM process permanently wedges at 100% CPU. Any application that calls ewe.read_body on chunked requests is affected, and this is exploitable by any unauthenticated remote client before control returns to application code, making an application-level workaround impossible. This issue is fixed in version 3.0.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
无效指针解引用
Source: CVE Program / CVE List V5
Vulnerability Title
ewe 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
ewe是Vladislav Shakitskiy个人开发者的一个轻量级Web服务器构建包。 ewe 3.0.4及之前版本存在安全漏洞，该漏洞源于handle_trailers函数存在无限循环，可能导致拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| vshakitskiy | ewe | >= 0.8.0, < 3.0.5 | - |
|
II. Public POCs for CVE-2026-32873
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-32873
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-32873 (2)
-
use buffers · vshakitskiy/ewe@8513de9 · GitHub x_refsource_MISC
-
patch the loop · vshakitskiy/ewe@d8b9b8a · GitHub x_refsource_MISC
Vendor Advisories for CVE-2026-32873 (1)
IV. Related Vulnerabilities
Same weakness: CWE-825
-
CVE-2026-86845
Dpdk: dpdk: guest-triggered use-after-free and type confusio -
CVE-2026-19939
Bluetooth Classic AVDTP: stale timeout work on signalling-ch -
CVE-2026-104039
Sssd: sssd: denial of service via stale connection state reu -
CVE-2026-104034
Sssd: sssd: denial of service via use-after-free in kcm tick -
CVE-2026-102010
Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of serv
V. Comments for CVE-2026-32873
No comments yet