CVE-2026-32688

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32688", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-03-13T09:12:14.475Z", "datePublished": "2026-04-27T13:45:35.160Z", "dateUpdated": "2026-04-29T17:08:07.227Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:elixir-plug:plug_cowboy:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Plug.Cowboy.Conn'"], "packageName": "plug_cowboy", "packageURL": "pkg:hex/plug_cowboy", "product": "plug_cowboy", "programFiles": ["lib/plug/cowboy/conn.ex"], "programRoutines": [{"name": "'Elixir.Plug.Cowboy.Conn':conn/1"}], "repo": "https://github.com/elixir-plug/plug_cowboy", "vendor": "elixir-plug", "versions": [{"lessThan": "2.8.1", "status": "affected", "version": "2.0.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:elixir-plug:plug_cowboy:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Plug.Cowboy.Conn'"], "packageName": "elixir-plug/plug_cowboy", "packageURL": "pkg:github/elixir-plug/plug_cowboy", "product": "plug_cowboy", "programFiles": ["lib/plug/cowboy/conn.ex"], "programRoutines": [{"name": "'Elixir.Plug.Cowboy.Conn':conn/1"}], "repo": "https://github.com/elixir-plug/plug_cowboy", "vendor": "elixir-plug", "versions": [{"lessThan": "bfb34cb45eb354e56437f7023fb306de1bf9c19b", "status": "affected", "version": "12ecfd024bb179d48b018fecf074e43fe6a19c83", "versionType": "git"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:elixir-plug:plug_cowboy:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.8.1", "versionStartIncluding": "2.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "finder", "value": "Peter Ullrich"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-plug plug_cowboy allows unauthenticated remote denial of service via atom table exhaustion.<p><tt>Plug.Cowboy.Conn.conn/1</tt> in <tt>lib/plug/cowboy/conn.ex</tt> calls <tt>String.to_atom/1</tt> on the value returned by <tt>:cowboy_req.scheme/1</tt>. For HTTP/2 connections, cowlib passes the client-supplied <tt>:scheme</tt> pseudo-header value through verbatim without validation. Each unique value permanently allocates a new entry in the BEAM atom table. Since atoms are never garbage-collected and the atom table has a fixed limit (default 1,048,576), an unauthenticated attacker can exhaust the table by sending HTTP/2 requests with unique <tt>:scheme</tt> values, causing the Erlang VM to abort with <tt>system_limit</tt> and taking down the entire node.</p><p>This vulnerability does not affect HTTP/1.1, where cowboy derives the scheme from the listener type rather than from a client-supplied header.</p><p>This issue affects plug_cowboy: from 2.0.0 before 2.8.1.</p>"}], "value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-plug plug_cowboy allows unauthenticated remote denial of service via atom table exhaustion.\n\nPlug.Cowboy.Conn.conn/1 in lib/plug/cowboy/conn.ex calls String.to_atom/1 on the value returned by :cowboy_req.scheme/1. For HTTP/2 connections, cowlib passes the client-supplied :scheme pseudo-header value through verbatim without validation. Each unique value permanently allocates a new entry in the BEAM atom table. Since atoms are never garbage-collected and the atom table has a fixed limit (default 1,048,576), an unauthenticated attacker can exhaust the table by sending HTTP/2 requests with unique :scheme values, causing the Erlang VM to abort with system_limit and taking down the entire node.\n\nThis vulnerability does not affect HTTP/1.1, where cowboy derives the scheme from the listener type rather than from a client-supplied header.\n\nThis issue affects plug_cowboy: from 2.0.0 before 2.8.1."}], "impacts": [{"capecId": "CAPEC-125", "descriptions": [{"lang": "en", "value": "CAPEC-125 Flooding"}]}], "metrics": [{"cvssV4_0": {"attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-04-29T17:08:07.227Z"}, "references": [{"tags": ["vendor-advisory", "related"], "url": "https://github.com/elixir-plug/plug_cowboy/security/advisories/GHSA-q8x4-x7mp-5vg2"}, {"tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-32688.html"}, {"tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-32688"}, {"tags": ["patch"], "url": "https://github.com/elixir-plug/plug_cowboy/commit/bfb34cb45eb354e56437f7023fb306de1bf9c19b"}], "source": {"discovery": "EXTERNAL"}, "title": "Atom table exhaustion via HTTP/2 :scheme pseudo-header in plug_cowboy", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Disable HTTP/2 on the <tt>Plug.Cowboy.https/3</tt> listener by passing <tt>protocol_options: %{protocols: [:http]}</tt> in the cowboy options. This restricts the listener to HTTP/1.1, where the scheme is derived from the listener type and is not attacker-controlled."}], "value": "Disable HTTP/2 on the Plug.Cowboy.https/3 listener by passing protocol_options: %{protocols: [:http]} in the cowboy options. This restricts the listener to HTTP/1.1, where the scheme is derived from the listener type and is not attacker-controlled."}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-27T19:04:33.154446Z", "id": "CVE-2026-32688", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T20:11:22.651Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32688", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-27T19:04:33.154446Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T19:04:40.353Z"}}], "cna": {"title": "Atom table exhaustion via HTTP/2 :scheme pseudo-header in plug_cowboy", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Peter Ullrich"}], "impacts": [{"capecId": "CAPEC-125", "descriptions": [{"lang": "en", "value": "CAPEC-125 Flooding"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "USER", "baseScore": 8.7, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "RED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:elixir-plug:plug_cowboy:*:*:*:*:*:*:*:*"], "repo": "https://github.com/elixir-plug/plug_cowboy", "vendor": "elixir-plug", "modules": ["'Elixir.Plug.Cowboy.Conn'"], "product": "plug_cowboy", "versions": [{"status": "affected", "version": "2.0.0", "lessThan": "2.8.1", "versionType": "semver"}], "packageURL": "pkg:hex/plug_cowboy", "packageName": "plug_cowboy", "programFiles": ["lib/plug/cowboy/conn.ex"], "collectionURL": "https://repo.hex.pm", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Plug.Cowboy.Conn':conn/1"}]}, {"cpes": ["cpe:2.3:a:elixir-plug:plug_cowboy:*:*:*:*:*:*:*:*"], "repo": "https://github.com/elixir-plug/plug_cowboy", "vendor": "elixir-plug", "modules": ["'Elixir.Plug.Cowboy.Conn'"], "product": "plug_cowboy", "versions": [{"status": "affected", "version": "12ecfd024bb179d48b018fecf074e43fe6a19c83", "lessThan": "bfb34cb45eb354e56437f7023fb306de1bf9c19b", "versionType": "git"}], "packageURL": "pkg:github/elixir-plug/plug_cowboy", "packageName": "elixir-plug/plug_cowboy", "programFiles": ["lib/plug/cowboy/conn.ex"], "collectionURL": "https://github.com", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Plug.Cowboy.Conn':conn/1"}]}], "references": [{"url": "https://github.com/elixir-plug/plug_cowboy/security/advisories/GHSA-q8x4-x7mp-5vg2", "tags": ["vendor-advisory", "related"]}, {"url": "https://cna.erlef.org/cves/CVE-2026-32688.html", "tags": ["related"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-32688", "tags": ["related"]}, {"url": "https://github.com/elixir-plug/plug_cowboy/commit/bfb34cb45eb354e56437f7023fb306de1bf9c19b", "tags": ["patch"]}], "workarounds": [{"lang": "en", "value": "Disable HTTP/2 on the Plug.Cowboy.https/3 listener by passing protocol_options: %{protocols: [:http]} in the cowboy options. This restricts the listener to HTTP/1.1, where the scheme is derived from the listener type and is not attacker-controlled.", "supportingMedia": [{"type": "text/html", "value": "Disable HTTP/2 on the <tt>Plug.Cowboy.https/3</tt> listener by passing <tt>protocol_options: %{protocols: [:http]}</tt> in the cowboy options. This restricts the listener to HTTP/1.1, where the scheme is derived from the listener type and is not attacker-controlled.", "base64": false}]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-plug plug_cowboy allows unauthenticated remote denial of service via atom table exhaustion.\n\nPlug.Cowboy.Conn.conn/1 in lib/plug/cowboy/conn.ex calls String.to_atom/1 on the value returned by :cowboy_req.scheme/1. For HTTP/2 connections, cowlib passes the client-supplied :scheme pseudo-header value through verbatim without validation. Each unique value permanently allocates a new entry in the BEAM atom table. Since atoms are never garbage-collected and the atom table has a fixed limit (default 1,048,576), an unauthenticated attacker can exhaust the table by sending HTTP/2 requests with unique :scheme values, causing the Erlang VM to abort with system_limit and taking down the entire node.\n\nThis vulnerability does not affect HTTP/1.1, where cowboy derives the scheme from the listener type rather than from a client-supplied header.\n\nThis issue affects plug_cowboy: from 2.0.0 before 2.8.1.", "supportingMedia": [{"type": "text/html", "value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-plug plug_cowboy allows unauthenticated remote denial of service via atom table exhaustion.<p><tt>Plug.Cowboy.Conn.conn/1</tt> in <tt>lib/plug/cowboy/conn.ex</tt> calls <tt>String.to_atom/1</tt> on the value returned by <tt>:cowboy_req.scheme/1</tt>. For HTTP/2 connections, cowlib passes the client-supplied <tt>:scheme</tt> pseudo-header value through verbatim without validation. Each unique value permanently allocates a new entry in the BEAM atom table. Since atoms are never garbage-collected and the atom table has a fixed limit (default 1,048,576), an unauthenticated attacker can exhaust the table by sending HTTP/2 requests with unique <tt>:scheme</tt> values, causing the Erlang VM to abort with <tt>system_limit</tt> and taking down the entire node.</p><p>This vulnerability does not affect HTTP/1.1, where cowboy derives the scheme from the listener type rather than from a client-supplied header.</p><p>This issue affects plug_cowboy: from 2.0.0 before 2.8.1.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:elixir-plug:plug_cowboy:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.8.1", "versionStartIncluding": "2.0.0"}], "operator": "OR"}], "operator": "AND"}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-04-28T04:25:01.084Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32688", "state": "PUBLISHED", "dateUpdated": "2026-04-28T04:25:01.084Z", "dateReserved": "2026-03-13T09:12:14.475Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-04-27T13:45:35.160Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:elixir-plug:plug_cowboy:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Plug.Cowboy.Conn'"], "packageName": "plug_cowboy", "packageURL": "pkg:hex/plug_cowboy", "product": "plug_cowboy", "programFiles": ["lib/plug/cowboy/conn.ex"], "programRoutines": [{"name": "'Elixir.Plug.Cowboy.Conn':conn/1"}], "repo": "https://github.com/elixir-plug/plug_cowboy", "vendor": "elixir-plug", "versions": [{"lessThan": "2.8.1", "status": "affected", "version": "2.0.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:elixir-plug:plug_cowboy:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Plug.Cowboy.Conn'"], "packageName": "elixir-plug/plug_cowboy", "packageURL": "pkg:github/elixir-plug/plug_cowboy", "product": "plug_cowboy", "programFiles": ["lib/plug/cowboy/conn.ex"], "programRoutines": [{"name": "'Elixir.Plug.Cowboy.Conn':conn/1"}], "repo": "https://github.com/elixir-plug/plug_cowboy", "vendor": "elixir-plug", "versions": [{"lessThan": "bfb34cb45eb354e56437f7023fb306de1bf9c19b", "status": "affected", "version": "12ecfd024bb179d48b018fecf074e43fe6a19c83", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:elixir-plug:plug.cowboy:*:*:*:*:*:*:*:*", "matchCriteriaId": "D18EA080-8E40-4503-AA95-54EF882FE1D7", "versionEndExcluding": "2.8.1", "versionStartIncluding": "2.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-plug plug_cowboy allows unauthenticated remote denial of service via atom table exhaustion.\n\nPlug.Cowboy.Conn.conn/1 in lib/plug/cowboy/conn.ex calls String.to_atom/1 on the value returned by :cowboy_req.scheme/1. For HTTP/2 connections, cowlib passes the client-supplied :scheme pseudo-header value through verbatim without validation. Each unique value permanently allocates a new entry in the BEAM atom table. Since atoms are never garbage-collected and the atom table has a fixed limit (default 1,048,576), an unauthenticated attacker can exhaust the table by sending HTTP/2 requests with unique :scheme values, causing the Erlang VM to abort with system_limit and taking down the entire node.\n\nThis vulnerability does not affect HTTP/1.1, where cowboy derives the scheme from the listener type rather than from a client-supplied header.\n\nThis issue affects plug_cowboy: from 2.0.0 before 2.8.1."}, {"lang": "es", "value": "Vulnerabilidad de asignaci\u00f3n de recursos sin l\u00edmites ni estrangulamiento en elixir-plug plug_cowboy permite la denegaci\u00f3n de servicio remota no autenticada mediante el agotamiento de la tabla de \u00e1tomos.\n\nPlug.Cowboy.Conn.conn/1 en lib/plug/cowboy/conn.ex llama a String.to_atom/1 sobre el valor devuelto por :cowboy_req.scheme/1. Para conexiones HTTP/2, cowlib pasa el valor del pseudo-encabezado :scheme suministrado por el cliente directamente sin validaci\u00f3n. Cada valor \u00fanico asigna permanentemente una nueva entrada en la tabla de \u00e1tomos de BEAM. Dado que los \u00e1tomos nunca son recolectados por el recolector de basura y la tabla de \u00e1tomos tiene un l\u00edmite fijo (predeterminado 1,048,576), un atacante no autenticado puede agotar la tabla enviando solicitudes HTTP/2 con valores :scheme \u00fanicos, haciendo que la VM de Erlang aborte con system_limit y derribe todo el nodo.\n\nEsta vulnerabilidad no afecta a HTTP/1.1, donde cowboy deriva el esquema del tipo de oyente en lugar de un encabezado suministrado por el cliente.\n\nEste problema afecta a plug_cowboy: desde 2.0.0 antes de 2.8.1."}], "id": "CVE-2026-32688", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32688", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-27T19:04:33.154446Z", "version": "2.0.3"}}]}, "published": "2026-04-27T14:16:47.340", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Third Party Advisory"], "url": "https://cna.erlef.org/cves/CVE-2026-32688.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Patch"], "url": "https://github.com/elixir-plug/plug_cowboy/commit/bfb34cb45eb354e56437f7023fb306de1bf9c19b"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Vendor Advisory"], "url": "https://github.com/elixir-plug/plug_cowboy/security/advisories/GHSA-q8x4-x7mp-5vg2"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Third Party Advisory"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-32688"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0,2.8.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[12ecfd024bb179d48b018fecf074e43fe6a19c83,bfb34cb45eb354e56437f7023fb306de1bf9c19b)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "inferred", "scores": [{"score": 100.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "plug_cowboy", "source": "cna", "vendor": "elixir-plug"}, "product": "plug_cowboy", "vendor": "elixir-plug"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[12ecfd024bb179d48b018fecf074e43fe6a19c83,bfb34cb45eb354e56437f7023fb306de1bf9c19b)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "plug_cowboy", "source": "cna", "vendor": "elixir-plug"}, "product": "plug_cowboy", "vendor": "elixir-plug"}], "analysis": {"en": {"generated_at": "2026-04-28T04:25:04.614367+00:00", "value": {"mitigation_remediation": ["Upgrade Plug.Cowboy to version 2.8.1 or later, where the processing of :scheme values has been sanitized. ", "If an upgrade is not immediately possible, disable HTTP/2 on the Plug.Cowboy listener by configuring protocol_options: %{protocols: [:http]} to force HTTP/1.1 traffic and prevent the creation of attacker\u2011controlled atoms. ", "After applying the patch or disabling HTTP/2, actively monitor the BEAM atom table size and node stability to detect any unexpected resource exhaustion before it leads to a crash."], "summary": {"action": "Apply Patch", "impact": "Denial of Service via atom table exhaustion"}, "threat_synthesis": {"affected_systems": "The issue affects the elixir\u2011plug plug_cowboy library versions 2.0.0 through 2.8.0. It is present in setups that enable HTTP/2 on Plug.Cowboy listeners; HTTP/1.1 listeners are not vulnerable because the scheme is derived from the listener type instead of a client\u2011supplied header.", "description_and_impact": "The vulnerability arises when Plug.Cowboy.Conn.conn/1 converts the :scheme pseudo\u2011header from an HTTP/2 request into an Erlang atom without validation. Atoms are permanent and the BEAM atom table has a fixed size of 1,048,576 entries. An unauthenticated attacker can provide many distinct :scheme values, causing the table to grow until the VM aborts with a system_limit exception. The effect is a service crash that takes down the entire Erlang node. This weakness falls under CWE\u2011770 (Allocation of Resources Without Limits or Throttling).", "risk_and_exploitability": "The CVSS score of 8.7 indicates a high severity. EPSS data is currently not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be network\u2011based, using unauthenticated HTTP/2 traffic. An attacker needs only to send HTTP/2 requests with unique :scheme headers; no authentication or privileged access is required. Because the atom table is not naturally throttled, exploitation likelihood remains high with no countermeasures in place."}}}}, "created": "2026-04-28T00:45:16.945389+00:00", "updated": "2026-04-28T04:30:21.149108+00:00", "vendors": ["elixir-plug", "elixir-plug$PRODUCT$plug_cowboy"]}