[From nobody Fri Jun 19 18:55:07 2026
Received: (at submit) by bugs.debian.org; 24 May 2026 19:14:48 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
 (2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-9.9 required=4.0 tests=BAYES_00, FOURLA,
 FROMDEVELOPER, 
 NO_RELAYS,XMAILER_REPORTBUG autolearn=ham autolearn_force=no
 version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 35; hammy, 150; neutral, 107; spammy,
 0. spammytokens: hammytokens:0.000-+--H*F:U*carnil,
 0.000-+--XDebbugsCc, 0.000-+--X-Debbugs-Cc, 0.000-+--HTo:N*Debian,
 0.000-+--H*Ad:N*Bug
Return-path: <carnil@debian.org>
Received: via submission by buxtehude.debian.org with esmtp (Exim 4.96)
 (envelope-from <carnil@debian.org>) id 1wREHf-0039xv-25
 for submit@bugs.debian.org; Sun, 24 May 2026 19:14:48 +0000
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
From: Salvatore Bonaccorso <carnil@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: erlang-cowboy: CVE-2026-8466
Message-ID: <177965008713.1812606.1869807386174913739.reportbug@eldamar.lan>
X-Mailer: reportbug 13.2.0
Date: Sun, 24 May 2026 21:14:47 +0200
Delivered-To: submit@bugs.debian.org

U291cmNlOiBlcmxhbmctY293Ym95ClZlcnNpb246IDIuMC4wfnByZS4xK2Rmc2cxLTQKU2V2ZXJp
dHk6IGdyYXZlClRhZ3M6IHNlY3VyaXR5IHVwc3RyZWFtCkp1c3RpZmljYXRpb246IHVzZXIgc2Vj
dXJpdHkgaG9sZQpYLURlYmJ1Z3MtQ2M6IGNhcm5pbEBkZWJpYW4ub3JnLCBEZWJpYW4gU2VjdXJp
dHkgVGVhbSA8dGVhbUBzZWN1cml0eS5kZWJpYW4ub3JnPgoKSGksCgpUaGUgZm9sbG93aW5nIHZ1
bG5lcmFiaWxpdHkgd2FzIHB1Ymxpc2hlZCBmb3IgZXJsYW5nLWNvd2JveS4KCk5vdGUgSSdtIG5v
dCBlbnRpcmVseSBjZXJ0YWluIHRoYXQgdGhlIHByZS4xIHZlcnNpb24gYSB3ZWxsIGNvbnRhaW5z
CmFscmVhZHkgdGhlIGlzc3VlLCBidXQgaW4gdGhlIGlkZWFsIGNhc2UgaW4gdGhlIG9jY3VyZW5j
ZSB0aGF0CmVybGFuZy1jb3dib3kgZXZlciBnZXQgbWlncmF0ZWQgdG8gdGVzdGluZywgdGhlbiBp
dCBzaG91bGQgYXMgd2VsbCBiZQp1cGRhdGVkIHRvIGF0IGxlYXN0IDIuMTUuMCB3aGljaCBjb250
YWlucyB0aGlzIGZpeC4KCkNWRS0yMDI2LTg0NjZbMF06CnwgQWxsb2NhdGlvbiBvZiBSZXNvdXJj
ZXMgV2l0aG91dCBMaW1pdHMgb3IgVGhyb3R0bGluZyB2dWxuZXJhYmlsaXR5CnwgaW4gbmluZW5p
bmVzIGNvd2JveSBhbGxvd3MgZGVuaWFsIG9mIHNlcnZpY2UgdmlhIHVuYm91bmRlZCBidWZmZXIK
fCBhY2N1bXVsYXRpb24gaW4gbXVsdGlwYXJ0IGhlYWRlciBwYXJzaW5nLiAgY293Ym95X3JlcTpy
ZWFkX3BhcnQvMyBpbgp8IHNyYy9jb3dib3lfcmVxLmVybCBhY2N1bXVsYXRlcyBpbmNvbWluZyBy
ZXF1ZXN0IGJ5dGVzIGludG8gYSBCdWZmZXIKfCBiaW5hcnkgd2l0aCBubyB1cHBlci1ib3VuZCBj
aGVjay4gV2hlbiBjb3dfbXVsdGlwYXJ0OnBhcnNlX2hlYWRlcnMvMgp8IHJldHVybnMgbW9yZSBv
ciB7bW9yZSwgQnVmZmVyMn0sIHRoZSBmdW5jdGlvbiByZWFkcyB1cCB0byBMZW5ndGgKfCBieXRl
cyAoZGVmYXVsdCA2NCBLQikgZnJvbSB0aGUgcmVxdWVzdCBib2R5IGFuZCByZWN1cnNlcyB3aXRo
IHRoZQp8IGVubGFyZ2VkIGJ1ZmZlci4gVGhlcmUgaXMgbm8gZXF1aXZhbGVudCBvZiB0aGUgYnl0
ZV9zaXplKEFjYykgPgp8IExlbmd0aCBndWFyZCBwcmVzZW50IGluIHRoZSBzaWJsaW5nIGZ1bmN0
aW9uIHJlYWRfcGFydF9ib2R5LzQuIEFuCnwgdW5hdXRoZW50aWNhdGVkIGF0dGFja2VyIGNhbiBz
ZW5kIGEgbXVsdGlwYXJ0L2Zvcm0tZGF0YSByZXF1ZXN0Cnwgd2hvc2UgYm9keSBuZXZlciB5aWVs
ZHMgYSBjb21wbGV0ZSBoZWFkZXIgc2VjdGlvbiDigJQgZm9yIGV4YW1wbGUsIGEKfCBib2R5IHRo
YXQgbmV2ZXIgY29udGFpbnMgdGhlIGFkdmVydGlzZWQgYm91bmRhcnkgZGVsaW1pdGVyLCBvciBv
bmUKfCB3aG9zZSBoZWFkZXIgbGluZXMgbmV2ZXIgY29udGFpbiBcclxuXHJcbiDigJQgYW5kIGZv
cmNlIHRoZSBzZXJ2ZXIKfCBwcm9jZXNzIHRvIGFjY3VtdWxhdGUgbWVtb3J5IGxpbmVhcmx5IHdp
dGggdGhlIGJ5dGVzIHRoZSBwcm90b2NvbAp8IGxheWVyIGlzIHdpbGxpbmcgdG8gZGVsaXZlci4g
QSBoYW5kZnVsIG9mIGNvbmN1cnJlbnQgc3VjaCB1cGxvYWRzIGlzCnwgc3VmZmljaWVudCB0byBl
eGhhdXN0IEJFQU0gbWVtb3J5LiAgVGhpcyBpc3N1ZSBhZmZlY3RzIGNvd2JveSBmcm9tCnwgMi4w
LjAgYmVmb3JlIDIuMTUuMC4KCgpJZiB5b3UgZml4IHRoZSB2dWxuZXJhYmlsaXR5IHBsZWFzZSBh
bHNvIG1ha2Ugc3VyZSB0byBpbmNsdWRlIHRoZQpDVkUgKENvbW1vbiBWdWxuZXJhYmlsaXRpZXMg
JiBFeHBvc3VyZXMpIGlkIGluIHlvdXIgY2hhbmdlbG9nIGVudHJ5LgoKRm9yIGZ1cnRoZXIgaW5m
b3JtYXRpb24gc2VlOgoKWzBdIGh0dHBzOi8vc2VjdXJpdHktdHJhY2tlci5kZWJpYW4ub3JnL3Ry
YWNrZXIvQ1ZFLTIwMjYtODQ2NgogICAgaHR0cHM6Ly93d3cuY3ZlLm9yZy9DVkVSZWNvcmQ/aWQ9
Q1ZFLTIwMjYtODQ2NgpbMV0gaHR0cHM6Ly9jbmEuZXJsZWYub3JnL2N2ZXMvQ1ZFLTIwMjYtODQ2
Ni5odG1sClsyXSBodHRwczovL29zdi5kZXYvdnVsbmVyYWJpbGl0eS9FRUYtQ1ZFLTIwMjYtODQ2
NgoKUmVnYXJkcywKU2FsdmF0b3JlCg==
]