Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
ninenines/cowboy
master @ 98502aa
15
Fixes
2
CVEs
HIGH
Peak severity
64.3%
Coverage
Highlights
Denial of Service: 11 prior fixes. Scrutinize any change in this area.
src/cowboy_http.erl: most-fixed (3 issues). Treat as high-risk during review.
4 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Denial of Service: Unbounded resource allocation in HTTP/2, including infinite CONTINUATION frame floods, rapid stream resets, and lack of connection-level rate limits, can cause severe memory exhaustion or CPU starvation. Mitigation relies on absolute limits like max_fragmented_header_block_size and rate limiters for stream cancellations.
Denial of Service: Unbounded buffer accumulation during multipart parsing (CVE-2026-8466) allows unauthenticated remote attackers to trigger out-of-memory crashes by transmitting large, crafted header blocks.
HTTP Request Smuggling: Failing to reject requests containing both Content-Length and Transfer-Encoding headers permits request smuggling, enabling security control bypasses and cache poisoning on downstream proxies.