---
id: CVE-2026-115701
title: >-
  Cowboy HTTP/1.1 Unbounded Buffering of Pipelined Data During Request Handling
  Enables Memory Exhaustion
summary: >-
  Allocation of Resources Without Limits or Throttling vulnerability in
  ninenines cowboy allows an unauthenticated remote attacker to exhaust
  connection process memory over HTTP/1.1.


  Once a request has been received in full and its handle…
severity: high
cvss: 8.2
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-770
vendor: ninenines
product: cowboy
affected:
  - cowboy >= 2.18.0 < *
  - >-
    ninenines/cowboy >= faf5594fbf74530ace90b0c46c936bdc2cf82081 <
    3a630c07e1521abf63a1b9ea080509aa1337b60d
published: '2026-11-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T10:29:00.314Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115701'
references:
  - url: 'https://cna.erlef.org/cves/CVE-2026-115701.html'
    label: EEF CNA record for CVE-2026-115701
  - url: 'https://osv.dev/vulnerability/EEF-CVE-2026-115701'
    label: OSV record EEF-CVE-2026-115701
  - url: >-
      https://github.com/ninenines/cowboy/commit/faf5594fbf74530ace90b0c46c936bdc2cf82081
    label: Introducing commit faf5594 in ninenines/cowboy
  - url: >-
      https://github.com/ninenines/cowboy/commit/3a630c07e1521abf63a1b9ea080509aa1337b60d
    label: Fix commit 3a630c0 in ninenines/cowboy
tags:
  - cve.org
ingestedAt: '2026-11-06T10:49:35.340Z'
epss: 0.00539
epssPercentile: 0.45597
---

## Overview

Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1.

Once a request has been received in full and its handler is still running, cowboy_http:parse/2 in src/cowboy_http.erl appends every further byte that arrives on the keep-alive connection to the connection buffer and returns to the receive loop without parsing it. The socket stays in active mode and no limit applies to this buffer: max_request_line_length, max_headers and the other parser limits only take effect once the handler returns and parsing resumes, and the only timer in this state is idle_timeout (default 60 seconds), which is reset on every received chunk. A client can therefore send an arbitrary amount of data on one connection for as long as the handler runs, and a few connections to an endpoint that holds requests open can drive the Erlang VM into out-of-memory conditions.

This issue affects cowboy: from 2.18.0 onward.

## Affected

- `cowboy >= 2.18.0 < *`
- `ninenines/cowboy >= faf5594fbf74530ace90b0c46c936bdc2cf82081 < 3a630c07e1521abf63a1b9ea080509aa1337b60d`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.