Skip to main content
cve.nowby Sazabi
← Hex
HexPackage

cowboy

4 known vulnerabilities (2 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 2 high, 2 medium
Registry
Hex

Advisories 4

  • Cowboy HTTP/1.1 Unbounded Buffering of Pipelined Data During Request Handling Enables Memory Exhaustion

    Affected: from 2.18.0; from 2.18.0.

  • CVE-2026-65624Medium 6.9

    Cowboy HTTP/1.1 max_headers Bypass via Duplicate Header Names Enables Memory Exhaustion

    Affected: from 2.0.0-pre.4, fixed in 2.18.0; from 2.0.0-pre.4, fixed in 2.18.0.

  • CVE-2026-43966Medium 6.3

    HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2

    Affected: fixed in 2.16.0.

  • Unbounded buffer accumulation in multipart header parsing causes denial of service in cowboy

    Affected: from 2.0.0, fixed in 2.15.0; from 2.0.0, fixed in 2.15.0.