cowboy HTTP/1.1 unbounded buffering of pipelined data exhausts memory
A web server part; a few connections can stop the server.
Summary
cowboy keeps buffering data sent on a connection while a request handler is still running, with no limit. An unauthenticated remote attacker can exhaust server memory with a few connections. Versions from 2.18.0 before 2.21.0 are affected.
Affected when
- HTTP/1.1 connections
- request handlers that hold the request open (long polling, streamed responses, slow backend calls)
What to do
Update to cowboy 2.21.0 or newer. Versions from 2.18.0 before 2.21.0 are affected.
Products and platforms
CVE IDs
Sources
- Write-up: cna.erlef.org (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen