CVE-2026-32688: plug_cowboy Atom Table Exhaustion via HTTP/2 :scheme Pseudo-header
Summary
CVE-2026-32688: Atom table exhaustion via HTTP/2 :scheme pseudo-header in plug_cowboy. Affects plug_cowboy across 2 version ranges.
>= 2.0.0, < 2.8.1
>= 12ecfd024bb179d48b018fecf074e43fe6a19c83, < bfb34cb45eb354e56437f7023fb306de1bf9c19b
Fixed in 2.8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
plug_cowboy is a widely used HTTP server for Elixir applications, built on top of the Cowboy server. It provides a simple interface for handling HTTP requests and is designed to be efficient and scalable. However, it is vulnerable to a denial of service attack due to improper handling of HTTP/2 requests, specifically related to the :scheme pseudo-header.
Vulnerability Detail
The vulnerability arises from the allocation of resources without limits or throttling in plug_cowboy. When handling HTTP/2 connections, the server calls String.to_atom on the client-supplied :scheme pseudo-header value without validation. Each unique value creates a new entry in the BEAM atom table, which is fixed in size and never garbage-collected. An attacker can exploit this by sending numerous unique :scheme values, leading to atom table exhaustion and causing the Erlang VM to abort, resulting in a denial of service.
How To Fix
Latest published version: 2.9.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.8.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable HTTP/2 on the Plug.Cowboy.https listener by modifying the protocol options. Use the following code snippet in your configuration:
Plug.Cowboy.https(:your_listener, YourPlug, [], protocol_options: %{protocols: [:http]})
Conclusion
CVE-2026-32688 is a critical vulnerability in the plug_cowboy package that can lead to denial of service through atom table exhaustion. It is essential to update to the patched version or implement the provided workaround to mitigate the risk.
See every vulnerability recorded for plug_cowboy →
FAQ
CVE-2026-32688 is a vulnerability in the plug_cowboy package that allows for denial of service attacks through atom table exhaustion via HTTP/2 requests.
If your application uses plug_cowboy and accepts HTTP/2 connections, it may be susceptible to denial of service attacks, potentially causing your application to crash.
The CVSS score for this vulnerability is 8.7, indicating a high severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If immediate updates are not possible, implement the suggested workaround to disable HTTP/2 on your listener until you can apply the patch.
