elixir-plug plug_cowboy up to 2.8.0 lib/plug/cowboy/conn.ex allocation of resources

Summaryinfo

A vulnerability described as problematic has been identified in elixir-plug plug_cowboy up to 2.8.0. This affects an unknown part in the library lib/plug/cowboy/conn.ex. Executing a manipulation can lead to allocation of resources. This vulnerability is tracked as CVE-2026-32688. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as problematic was found in elixir-plug plug_cowboy up to 2.8.0. This vulnerability affects an unknown code block in the library lib/plug/cowboy/conn.ex. The manipulation with an unknown input leads to a allocation of resources vulnerability. The CWE definition for the vulnerability is CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. As an impact it is known to affect availability. CVE summarizes:

Allocation of Resources Without Limits or Throttling vulnerability in elixir-plug plug_cowboy allows unauthenticated remote denial of service via atom table exhaustion. Plug.Cowboy.Conn.conn/1 in lib/plug/cowboy/conn.ex calls String.to_atom/1 on the value returned by :cowboy_req.scheme/1. For HTTP/2 connections, cowlib passes the client-supplied :scheme pseudo-header value through verbatim without validation. Each unique value permanently allocates a new entry in the BEAM atom table. Since atoms are never garbage-collected and the atom table has a fixed limit (default 1,048,576), an unauthenticated attacker can exhaust the table by sending HTTP/2 requests with unique :scheme values, causing the Erlang VM to abort with system_limit and taking down the entire node. This vulnerability does not affect HTTP/1.1, where cowboy derives the scheme from the listener type rather than from a client-supplied header. This issue affects plug_cowboy: from 2.0.0 before 2.8.1.

The weakness was disclosed by Peter Ullrich as GHSA-q8x4-x7mp-5vg2. The advisory is shared for download at github.com. This vulnerability was named CVE-2026-32688 since 03/13/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

Upgrading to version 2.8.1 eliminates this vulnerability. Applying the patch bfb34cb45eb354e56437f7023fb306de1bf9c19b is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-25845). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• elixir-plug

Name

• plug_cowboy

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8.0

License

• open-source

Website

• Product: https://github.com/elixir-plug/plug_cowboy/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion