cowboy vulnerabilities

ninenines cowboy has an Allocation of Resources Without Limits or Throttling vulnerability: cowboy_http:parse/2 buffers every further byte arriving on a keep-alive connection while the handler is still running, with no limit on buffer size. An unauthenticated remote attacker can send arbitrary amounts of data on one connection, driving the Erlang VM into out-of-memory conditions. This affects versions from 2.18.0 onward.

The cowboy HTTP server from version 2.0.0-pre.4 to 2.17.x is vulnerable to memory exhaustion due to unlimited resources. An unauthenticated attacker can send many HTTP/1.1 headers with the same name, causing continuous binary memory growth, potentially exhausting Erlang VM memory.

In cowboy (ninenines) from 2.0.0 before 2.15.0, `cowboy_req:read_part/3` accumulates request bytes into a buffer without an upper-bound check when multipart header parsing returns `more`. An unauthenticated attacker can send a multipart/form-data request that never yields a complete header section, causing linear memory growth and exhausting BEAM memory.