vshakitskiy ewe up to 3.0.4 handle_trailers expired pointer dereference

Summaryinfo

A vulnerability classified as problematic has been found in vshakitskiy ewe up to 3.0.4. This impacts the function handle_trailers. The manipulation leads to expired pointer dereference. This vulnerability is listed as CVE-2026-32873. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in vshakitskiy ewe up to 3.0.4 and classified as problematic. This issue affects the function handle_trailers. The manipulation with an unknown input leads to a expired pointer dereference vulnerability. Using CWE to declare the problem leads to CWE-825. The product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid. Impacted is availability. The summary by CVE is:

ewe is a Gleam web server. Versions 0.8.0 through 3.0.4 contain a bug in the handle_trailers function where rejected trailer headers (forbidden or undeclared) cause an infinite loop. When handle_trailers encounters such a trailer, three code paths (lines 520, 523, 526) recurse with the original buffer (rest) instead of advancing past the rejected header (Buffer(header_rest, 0)), causing decoder.decode_packet to re-parse the same header on every iteration. The resulting loop has no timeout or escape — the BEAM process permanently wedges at 100% CPU. Any application that calls ewe.read_body on chunked requests is affected, and this is exploitable by any unauthenticated remote client before control returns to application code, making an application-level workaround impossible. This issue is fixed in version 3.0.5.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-32873 since 03/16/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available.

Upgrading to version 3.0.5 eliminates this vulnerability. Applying the patch 8513de9dcdd0005f727c0f6f15dd89f8d626f560 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• vshakitskiy

Name

• ewe

Version

• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4

License

• open-source

Website

• Product: https://github.com/vshakitskiy/ewe/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion