CVE-2026-65624: 
RabbitMQ vulnerability analysis and mitigation

CVE-2026-65624 is an Allocation of Resources Without Limits or Throttling vulnerability in the ninenines Cowboy HTTP server that allows unauthenticated remote attackers to exhaust connection process memory via crafted HTTP/1.1 requests. It affects Cowboy versions from 2.0.0-pre.4 through 2.18.0 (exclusive), and was disclosed on July 28, 2026. The vulnerability was reported by Qiyi Deng and assigned by the Erlang Ecosystem Foundation (EEF). It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 6.9 (Medium) (Github Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-1050 (Excessive Platform Resource Consumption within a Loop). The cowboy_http HTTP/1.1 handler enforces the max_headers limit by calling maps:size(Headers), which counts only distinct header names. When a request contains multiple header lines sharing the same name, their values are concatenated into a single ever-growing binary under one map key (", " for regular headers, "; " for cookies), keeping the map size at one and never triggering the cap (default: 100). Because no bound exists on the total number of header lines or the total byte size of the header block — only per-line max_header_name_length and max_header_value_length limits apply — an unauthenticated client can send an unbounded number of same-name header lines and grow the connection process's binary heap arbitrarily within the request window. The fix, committed at 3a34d8c, introduces a separate num_headers counter incremented for every parsed header line regardless of name uniqueness (Cowboy Commit, Github Advisory).

Successful exploitation results in a Denial of Service (DoS) affecting availability only — there is no confidentiality or integrity impact. An unauthenticated attacker can cause the Erlang VM to enter out-of-memory conditions by sustaining connections that send large numbers of duplicate-named headers, potentially crashing or severely degrading any service built on Cowboy. The impact per individual connection is partially bounded by the request_timeout (default 5 seconds) and by max_heap_size if configured, but with default settings (no max_heap_size), repeated abuse across multiple connections can exhaust system memory (Github Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Github Advisory). The vulnerability is rated automatable by NVD SSVC, meaning it can be exploited at scale without user interaction. The EPSS score is approximately 0.38% (31st percentile), indicating a low but non-negligible probability of exploitation within 30 days. No threat actor attribution is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify internet-facing services running Cowboy versions 2.0.0-pre.4 through 2.17.x using banner grabbing, Shodan, or Censys searches for Erlang/Cowboy HTTP servers.
2. Craft malicious HTTP/1.1 request: Construct an HTTP/1.1 GET or POST request containing a large number of header lines all sharing the same header name (e.g., X-Custom: value) — well beyond the default max_headers limit of 100.
3. Send the request: Transmit the crafted request to the target Cowboy server. Because cowboy_http counts only distinct header names via maps:size(), the duplicate headers bypass the max_headers check while their values are concatenated into an ever-growing binary in the connection process heap.
4. Exhaust memory: Repeat across multiple concurrent connections within the request_timeout window (default 5 seconds). Without max_heap_size configured, each connection process accumulates unbounded binary memory, progressively driving the Erlang VM toward out-of-memory conditions and service unavailability (Cowboy Commit, Github Advisory).

• Network: High volumes of HTTP/1.1 requests from one or more source IPs containing an unusually large number of headers; requests with many repeated header names (e.g., dozens of X-*: value or Cookie: a=b lines in a single request.
• Logs: Cowboy/Erlang application logs showing connection process crashes or max_heap_size kill events; HTTP 431 (Request Header Fields Too Large) responses in access logs may indicate probing activity.
• Process/Runtime: Erlang VM reporting out-of-memory (OOM) conditions or abnormal memory growth in connection handler processes; unexpected process terminations in the Erlang observer or crash dumps referencing cowboy_http processes with large binary heap sizes.

Upgrade Cowboy to version 2.18.0 or later, which fixes the header counting logic to use a separate num_headers counter that increments for every parsed header line regardless of name uniqueness (Cowboy Commit, Github Advisory). As a temporary workaround, configure max_heap_size for Erlang processes to limit the memory any single connection process can consume before being killed. Additionally, deploying a reverse proxy or load balancer with connection-level rate limiting and strict header count/size enforcement can reduce exposure until patching is possible (Red Hat Bugzilla).

Red Hat tracked the issue as high severity in their Bugzilla system and issued errata (RHSA-2026:47231 and RHSA-2026:47236) addressing the vulnerability in their product lines. The vulnerability was also picked up by AUSCERT (ESB-2026.8701, ESB-2026.8712) and INCIBE-CERT. No significant public researcher commentary or social media discussion has been identified beyond standard vulnerability database aggregation.