cowlib HTTP/2 header decoding lets remote peers exhaust server memory
Erlang web server parts can run out of memory and stall.
Summary
cowlib does not limit the decoded size of HTTP/2 headers, so an unauthenticated remote peer can make a server allocate large amounts of memory from about 100 bytes sent. Versions 2.7.0 before 2.22.0 are affected, including Cowboy HTTP/2 servers built on it.
Affected when
- cowlib 2.7.0 or later, before 2.22.0
- HTTP/2 enabled (such as a Cowboy listener)
What to do
Update to cowlib 2.22.0. Until then, Cowboy servers that do not need HTTP/2 can set protocols => [http]; lowering max_headers reduces the amplification but does not remove it.
Can't update yet?
Add this line to the config file:
protocols => [http]
A wrong setting can stop the service or lock you out. Check the source links below first.
Products and platforms
CVE IDs
Sources
- Write-up: cna.erlef.org (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen