VYPR
Get started
← All advisories
High severityNVD Advisory· Published Apr 27, 2026· Updated Apr 27, 2026

CVE-2026-32688

CVE-2026-32688

Description

Allocation of Resources Without Limits or Throttling vulnerability in elixir-plug plug_cowboy allows unauthenticated remote denial of service via atom table exhaustion.

Plug.Cowboy.Conn.conn/1 in lib/plug/cowboy/conn.ex calls String.to_atom/1 on the value returned by :cowboy_req.scheme/1. For HTTP/2 connections, cowlib passes the client-supplied :scheme pseudo-header value through verbatim without validation. Each unique value permanently allocates a new entry in the BEAM atom table. Since atoms are never garbage-collected and the atom table has a fixed limit (default 1,048,576), an unauthenticated attacker can exhaust the table by sending HTTP/2 requests with unique :scheme values, causing the Erlang VM to abort with system_limit and taking down the entire node.

This vulnerability does not affect HTTP/1.1, where cowboy derives the scheme from the listener type rather than from a client-supplied header.

This issue affects plug_cowboy: from 2.0.0 before 2.8.1.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
plug_cowboyHex
>= 2.0.0, < 2.8.12.8.1

Affected products

1

Patches

1
bfb34cb45eb3

Merge commit from fork

https://github.com/elixir-plug/plug_cowboyGary RennieApr 27, 2026via ghsa
commit
1 file changed · +7 −1
  • lib/plug/cowboy/conn.ex+7 −1 modified
    @@ -15,6 +15,12 @@ defmodule Plug.Cowboy.Conn do
       peer: {remote_ip, _}
     } = req
 
+    scheme =
+      case :cowboy_req.scheme(req) do
+        "http" -> :http
+        "https" -> :https
+      end
+
     %Plug.Conn{
       adapter: {__MODULE__, Map.put(req, :plug_pid, self())},
       host: host,
@@ -26,7 +32,7 @@ defmodule Plug.Cowboy.Conn do
       query_string: qs,
       req_headers: to_headers_list(headers),
       request_path: path,
-      scheme: String.to_atom(:cowboy_req.scheme(req))
+      scheme: scheme
     }
   end

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.