A remote attacker can send a large amount of data on a keep‑alive HTTP/1.1 connection after a request has been fully received. While the handler is still executing, the Cowboy HTTP server appends every new byte to the connection buffer without applying any size limits. This causes the Erlang VM to allocate more memory for each incoming data chunk, eventually exhausting available RAM and failing all connections. The vulnerability is a classic uncontrolled resource consumption flaw—CWE‑770—and results in a local denial‑of‑service that can be triggered without authentication.

The flaw exists in the Cowboy web server library developed by ninenines. Any application that incorporates Cowboy 2.18.0 or later is affected, including Erlang/OTP environments that embed Cowboy as the HTTP handler.

The CVSS score of 8.2 reflects a high exploitation severity. The attack vector is remote and unauthenticated; an attacker only needs the ability to maintain a persistent connection and send arbitrary data. Although no EPSS score is available, the simplicity of the trigger means an exploit can be built quickly. The vulnerability is not listed in the CISA KEV catalog, but the lack of a request size limit means the resource exhaustion attack is likely to succeed against any environment running the affected Cowboy version.