The vulnerability is an unbounded buffer accumulation during multipart header parsing in Cowboy. The function that reads multipart parts stores incoming bytes into an internal buffer with no size limit. As a result, a malicious request can cause the server process to consume memory linearly until the BEAM system’s heap is exhausted, leading to denial of service. The flaw is defined as CWE‑770.

The affected product is the Cowboy web server from NineNines, versions from 2.0.0 up to, but not including, 2.15.0. These releases are vulnerable to memory exhaustion when handling malformed multipart/form‑data requests.

The CVSS score of 8.2 classifies the issue as high severity, yet the EPSS score is not presently available and the vulnerability is not listed in CISA KEV. An unauthenticated attacker only needs the ability to contact the HTTP service and can send multipart/form‑data requests that never provide the required boundary or terminating CRLF. The attacker can launch several concurrent uploads or send a very large malformed request to force the server to accumulate memory until it fails, effectively denying service. The exploit requires only network access to the server, no credentials, and is straightforward to execute with common HTTP clients.