CVE-2026-32688 json
Atom table exhaustion via HTTP/2 :scheme pseudo-header in plug_cowboy
published 2026-04-27 6 mo ago modified 2026-10-26 13 d ago also EEF-CVE-2026-32688 , EUVD-2026-25845 , GHSA-q8x4-x7mp-5vg2
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 46%
- public exploits
- 0
- none known
Summary
Allocation of Resources Without Limits or Throttling vulnerability in elixir-plug plug_cowboy allows unauthenticated remote denial of service via atom table exhaustion.
Plug.Cowboy.Conn.conn/1 in lib/plug/cowboy/conn.ex calls String.to_atom/1 on the value returned by :cowboy_req.scheme/1. For HTTP/2 connections, cowlib passes the client-supplied :scheme pseudo-header value through verbatim without validation. Each unique value permanently allocates a new entry in the BEAM atom table. Since atoms are never garbage-collected and the atom table has a fixed limit (default 1,048,576), an unauthenticated attacker can exhaust the table by sending HTTP/2 requests with unique :scheme values, causing the Erlang VM to abort with system_limit and taking down the entire node.
This vulnerability does not affect HTTP/1.1, where cowboy derives the scheme from the listener type rather than from a client-supplied header.
This issue affects plug_cowboy: from 2.0.0 before 2.8.1.
Patch / fix
- hex plug_cowboy 2.8.1
- elixir-plug plug_cowboy 2.8.1
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 6 mo ago
Exploit prediction
0.55% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| hex | plug_cowboy | >=2.0.0, <2.8.1 |
2.8.1 |
Affected products
- elixir-plug plug_cowboy
Classification
- Weakness
-
- CWE-770 Allocation of Resources Without Limits or Throttling
References
-
github.com
/elixir-plug/plug_cowboy/commit/bfb34cb45eb354e56437f7023fb306de1bf9c19b
patch, web
-
github.com
/elixir-plug/plug_cowboy/security/advisories/GHSA-q8x4-x7mp-5vg2
vendor-advisory, related, web, advisory
-
cna.erlef.org
/cves/CVE-2026-32688.html
related, web, third-party-advisory
-
osv.dev
/vulnerability/EEF-CVE-2026-32688
related, web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-32688
advisory
-
github.com
/elixir-plug/plug_cowboy
package
-
hex.pm
/packages/plug_cowboy
package
Sources
- CVE List CVE-2026-32688
- GitHub Advisory GHSA-q8x4-x7mp-5vg2
- NVD CVE-2026-32688
- OSV EEF-CVE-2026-32688
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.