An attacker who can send an HTTP/1.1 request can exploit Cowboy’s handling of duplicate header names to create a request that contains many header lines with the same name. Each line’s value is concatenated into a single growing binary value in the server’s header map, so the map size never increases and the configured max_headers limit is never reached. Because no overall bounds are placed on the number or total size of these duplicate header lines, an unauthenticated client can craft a request that consumes an arbitrary amount of memory in the connection process. If the request timeout expires before the heap is exhausted, the connection is simply dropped, but if the heap limit (max_heap_size) is not set or is very high, sustained abuse can trigger an out‑of‑memory condition in the Erlang VM, potentially bringing down the entire application.

Cowboy, the Erlang HTTP server published by the ninenines community, is affected for all releases from 2.0.0‑pre.4 up to, but not including, version 2.18.0. The vulnerability is tied to the default max_headers value of 100 and the lack of a global header block size limit.

The CVSS score is 6.9, indicating a moderate severity. The EPSS score is below 1 %, suggesting a low probability of exploitation at the moment. The vulnerability is not listed in the CISA KEV catalog. The attack is likely to be performed remotely by sending a specially crafted HTTP request from an unauthenticated client that exploits the duplicated header behavior to exhaust memory within a single connection.