CVE-2026-32881: 
NixOS vulnerability analysis and mitigation

CVE-2026-32881 is an authentication bypass vulnerability in ewe, a Gleam web server, caused by improper chunked transfer encoding trailer handling. Versions 0.6.0 through 3.0.4 are affected; the issue was disclosed on March 14, 2026, and patched in version 3.0.5. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-183 (Permissive List of Allowed Inputs). When ewe.read_body processes a chunked HTTP request, the handle_trailers function in ewe/internal/http1.gleam merges declared trailer fields into req.headers via request.set_header. The original denylist (is_forbidden_trailer) only blocked 9 header names (transfer-encoding, content-length, host, cache-control, expect, max-forwards, pragma, range, te), leaving security-sensitive headers such as authorization, cookie, set-cookie, proxy-authorization, x-forwarded-for, x-forwarded-host, x-forwarded-proto, and x-real-ip unprotected. An unauthenticated attacker can declare these headers in the HTTP Trailer field and append them after the final 0\r\n chunk, causing request.set_header to overwrite legitimate values previously set by a reverse proxy or upstream middleware (GitHub Advisory, Patch Commit).

Successful exploitation allows an unauthenticated remote attacker to forge authentication credentials (e.g., inject or overwrite Authorization: Bearer tokens), hijack sessions via cookie injection, bypass IP-based rate limiting by spoofing x-forwarded-for or x-real-ip, and spoof proxy-trust headers. Any downstream middleware that reads headers after ewe.read_body is called — including authentication, session validation, and access control logic — will operate on attacker-controlled values. The CVSS assessment reflects a low integrity impact with no confidentiality or availability impact, though the practical security consequence of authentication bypass can be severe in affected deployments (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, consisting of concrete netcat-based shell commands that demonstrate header injection against a live ewe server. The vulnerability requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any network-accessible attacker. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.188%, indicating a low (but non-negligible) probability of exploitation in the near term (GitHub Advisory, Feedly).

1. Reconnaissance: Identify services running the ewe Gleam web server (versions 0.6.0–3.0.4) that accept chunked HTTP requests, particularly those behind a reverse proxy that sets security-sensitive headers like Authorization or X-Forwarded-For.
2. Craft malicious chunked request: Construct an HTTP request using Transfer-Encoding: chunked and declare the target header (e.g., authorization) in the Trailer field.
3. Inject trailer header: After the final 0\r\n chunk terminator, append the forged header value. Example to inject a Bearer token:

printf 'POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nTrailer: authorization\r\n\r\n4\r\ntest\r\n0\r\nauthorization: Bearer injected-token\r\n\r\n' | nc -w 2 localhost 8080

4. Overwrite proxy-set headers: To overwrite a legitimate Authorization header already set by a reverse proxy, include the original header in the request and then overwrite it via the trailer:

printf 'POST / HTTP/1.1\r\nHost: localhost:8080\r\nAuthorization: Bearer legitimate-token\r\nTransfer-Encoding: chunked\r\nTrailer: authorization\r\n\r\n4\r\ntest\r\n0\r\nauthorization: Bearer evil-token\r\n\r\n' | nc -w 2 localhost 8080

5. Achieve objective: The server's handle_trailers function merges the injected header into req.headers, and any downstream middleware reading authorization after ewe.read_body will see the attacker-controlled value, effectively bypassing authentication or spoofing identity (GitHub Advisory).

• Network: HTTP POST (or other method) requests with both Transfer-Encoding: chunked and a Trailer: header containing security-sensitive field names (e.g., authorization, cookie, x-forwarded-for); raw TCP connections using netcat or similar tools sending crafted chunked bodies to the ewe server port.
• Logs: Server access logs showing chunked requests where the declared Trailer field includes authorization, cookie, proxy-authorization, x-forwarded-for, x-forwarded-host, x-forwarded-proto, or x-real-ip; authentication successes from unexpected IP addresses or with tokens not issued by the legitimate identity provider.
• Application Behavior: Authentication or session validation succeeding for requests that should have been rejected; IP-based rate limiting not triggering despite high request volumes from a single source; middleware logging unexpected header values after body parsing (GitHub Advisory).

Upgrade ewe to version 3.0.5 or later, which replaces the permissive denylist with a strict allowlist (is_allowed_trailer) that only permits server-timing, content-digest, and repr-digest as valid trailer headers. As a temporary workaround, implement strict header validation in downstream middleware to re-validate or re-set critical headers (such as authorization and x-forwarded-for) from a trusted source after ewe.read_body is called, rather than trusting the merged request headers. The patch commits are available at 07dcfd2 and 94ab6e7 (GitHub Release v3.0.5, GitHub Advisory).

The vulnerability was reported by security researcher jtdowney and published by the ewe maintainer on March 14, 2026, via GitHub Security Advisories. No significant broader media coverage or notable community commentary beyond the advisory itself has been identified at this time (GitHub Advisory).