Weakness Type (CWE)

CWE-770 — CWE-770 Allocation of Resources Without Limits or Throttling

CAPEC

CVSS 4.0 Score

8.7

HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Vulnerability description

Allocation of Resources Without Limits or Throttling vulnerability in elixir-plug plug_cowboy allows unauthenticated remote denial of service via atom table exhaustion.

Plug.Cowboy.Conn.conn/1 in lib/plug/cowboy/conn.ex calls String.to_atom/1 on the value returned by :cowboy_req.scheme/1. For HTTP/2 connections, cowlib passes the client-supplied :scheme pseudo-header value through verbatim without validation. Each unique value permanently allocates a new entry in the BEAM atom table. Since atoms are never garbage-collected and the atom table has a fixed limit (default 1,048,576), an unauthenticated attacker can exhaust the table by sending HTTP/2 requests with unique :scheme values, causing the Erlang VM to abort with system_limit and taking down the entire node.

This vulnerability does not affect HTTP/1.1, where cowboy derives the scheme from the listener type rather than from a client-supplied header.

This issue affects plug_cowboy: from 2.0.0 before 2.8.1.

Affected

pkg:hex/plug_cowboy

Module Source File Routine
Plug.Cowboy.Conn lib/plug/cowboy/conn.ex Plug.Cowboy.Conn.conn/1
Status Type Version Changes / Fixed in
affected semver ⓘ 2.0.0 < 2.8.1

pkg:github/elixir-plug/plug_cowboy

Module Source File Routine
Plug.Cowboy.Conn lib/plug/cowboy/conn.ex Plug.Cowboy.Conn.conn/1
Status Type Version Changes / Fixed in
affected git ⓘ 12ecfd024b < bfb34cb45e

Workarounds

Disable HTTP/2 on the Plug.Cowboy.https/3 listener by passing protocol_options: %{protocols: [:http]} in the cowboy options. This restricts the listener to HTTP/1.1, where the scheme is derived from the listener type and is not attacker-controlled.

References

Credits

  • Finder: Peter Ullrich

CVE record as JSON:  GET /cves/CVE-2026-32688.json
OSV record as JSON:  GET /osv/EEF-CVE-2026-32688.json