cowboy vulnerabilities

A vulnerability in the cowboy Erlang library allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1. Once a request has been fully received and its handler is still running, every further byte arriving on the keep-alive connection is appended to the connection buffer without any limit and without parsing. The idle_timeout (default 60 seconds) is reset on every received chunk, so a client can send arbitrary amounts of data and drive the Erlang VM into out-of-memory conditions.

The cowboy HTTP server from version 2.0.0-pre.4 to 2.17.x is vulnerable to memory exhaustion due to unlimited resources. An unauthenticated attacker can send many HTTP/1.1 headers with the same name, causing continuous binary memory growth, potentially exhausting Erlang VM memory.

In cowboy (ninenines) from 2.0.0 before 2.15.0, `cowboy_req:read_part/3` accumulates request bytes into a buffer without an upper-bound check when multipart header parsing returns `more`. An unauthenticated attacker can send a multipart/form-data request that never yields a complete header section, causing linear memory growth and exhausting BEAM memory.