[From nobody Wed Jul 29 14:41:07 2026 Received: (at submit) by bugs.debian.org; 29 Jul 2026 12:24:34 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-113.6 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,FOURLA, FROMDEVELOPER,MD5_SHA1_SUM,SPF_HELO_NONE,SPF_PASS, USER_IN_DKIM_WELCOMELIST,XMAILER_REPORTBUG autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 33; hammy, 150; neutral, 131; spammy, 0. spammytokens: hammytokens:0.000-+--Hx-spam-relays-external:sk:stravin, 0.000-+--H*RT:sk:stravin, 0.000-+--Hx-spam-relays-external:311, 0.000-+--H*RT:311, 0.000-+--H*RT:108 Return-path: <carnil@debian.org> Received: from stravinsky.debian.org ([2001:41b8:202:deb::311:108]:44374) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <carnil@debian.org>) id 1wp3Ks-00D9uL-0f for submit@bugs.debian.org; Wed, 29 Jul 2026 12:24:34 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:Date:Message-ID:Subject:To:From: Content-Transfer-Encoding:MIME-Version:Content-Type:Reply-To:Cc:Content-ID: Content-Description:In-Reply-To:References; bh=kplxeaZqxR7LzOqojqUgo+daBHTzTZXvMxzS3PBAgtU=; b=dGfrPMZc9OBrZ+yAJ/A0tbFAA3 T7txXHP4pimmIDllpcacWvCEu8Y4IY3sRJ1HeqCl0IP5eo41CPl18rIZFjgEJUZAskgt0eki+aorL 27b3iAxMiPta6TuYj0AMY8yjJNy2LeEgvkbrFPZS7L8TrRIc6QzuOjLecmDNsDnzqj46mHjGwYhFn dewPHCpz8fh+RhZ3XfTwlEd4IfM69MIM8jREeRGRVimADg2DYD6Q71N/jntqnQuKOqIlfIcKf0DzP cVJZokn5Q19B8iOo8L+nGmlP/fAFSka2CFuf00x2ipvrpumLriQ7RFho1q/rpblpfBKkupzveotQ+ tNCiDyRQ==; Received: from authenticated-user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <carnil@debian.org>) id 1wp3Kp-008Rri-04 for submit@bugs.debian.org; Wed, 29 Jul 2026 12:24:32 +0000 Received: from eldamar.lan (localhost [IPv6:::1]) by eldamar.lan (Postfix) with ESMTP id 940E7BE2EE7 for <submit@bugs.debian.org>; Wed, 29 Jul 2026 14:24:30 +0200 (CEST) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: Salvatore Bonaccorso <carnil@debian.org> To: Debian Bug Tracking System <submit@bugs.debian.org> Subject: erlang-cowboy: CVE-2026-65624 Message-ID: <178532787057.770446.13684972650924656999.reportbug@eldamar.lan> X-Mailer: reportbug 13.2.0+nmu1 Date: Wed, 29 Jul 2026 14:24:30 +0200 X-Debian-User: carnil Delivered-To: submit@bugs.debian.org Source: erlang-cowboy Version: 2.17.0+dfsg-1 Severity: important Tags: security upstream X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org> Hi, The following vulnerability was published for erlang-cowboy. CVE-2026-65624[0]: | Allocation of Resources Without Limits or Throttling vulnerability | in ninenines cowboy allows an unauthenticated remote attacker to | exhaust connection process memory over HTTP/1.1. The HTTP/1.1 | handler in cowboy_http enforces the max_headers limit by counting | the number of distinct header names in a map (maps:size(Headers)). | When a request contains multiple header lines with the same name, | the values are concatenated into a single ever-growing binary stored | under that one map key (", " for regular headers, "; " for cookies), | so the map size stays at one and the max_headers cap (default 100) | is never reached. Because no accumulator bounds the total number of | header lines or the total byte size of the header block (only per- | line max_header_name_length and max_header_value_length apply), an | unauthenticated client can send an arbitrary number of header lines | with the same name and grow the connection process's binary memory | to arbitrary size within the request window. The impact per | connection is bounded by request_timeout (default 5 seconds, not | reset by header data), and by max_heap_size when set (the offending | connection process is killed once its heap grows past the limit). | When max_heap_size is left at the default (unset), sustained abuse | can drive the Erlang VM into out-of-memory conditions. This issue | affects cowboy from 2.0.0-pre.4 before 2.18.0. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-65624 https://www.cve.org/CVERecord?id=CVE-2026-65624 [1] https://cna.erlef.org/cves/CVE-2026-65624.html [2] https://osv.dev/vulnerability/EEF-CVE-2026-65624 [3] https://github.com/ninenines/cowboy/commit/3a34d8c1cfd94326466aa16a9017236691dc9c55 Regards, Salvatore ]