The eave server processes HTTP chunked requests with a function that parses trailer headers. In versions 0.8.0 through 3.0.4, if an attacker includes a forbidden or undeclared trailer header, the parsing logic recurses with the same buffer rather than advancing, creating an infinite loop. The core VM running the server, BEAM, then consumes 100 % of CPU indefinitely, causing the process to become permanently unresponsive. This flaw, classified as CWE‑825 and CWE‑835, results in a denial of service. Because the loop is triggered before application code runs, any unauthenticated remote client can provoke the effect; no application‑level mitigation can prevent it.

The affected product is the Gleam web server named ewe, produced by vshakitskiy. Vulnerable releases include all versions from 0.8.0 up to and including 3.0.4. Any deployment that uses ewe.read_body to handle chunked requests and exposes a public HTTP endpoint is affected. The bug resides in the handle_trailers function, so any server configured to support chunked transfer encoding is at risk.

The vulnerability carries a CVSS score of 7.5, indicating high severity, and an EPSS score of less than 1 %, suggesting low but non‑zero exploitation probability. It is not listed in the CISA KEV catalog. An attacker can trigger the denial of service by sending an unauthenticated HTTP request containing a forbidden or undeclared trailer header in a chunked payload. The BEAM process will then enter a permanent, non‑timeout loop, maintaining 100 % CPU usage until the process is manually restarted or terminated. Because the attack occurs before the application code is executed, it cannot be mitigated by application‑level controls.