The vulnerability CVE-2026-32688 in elixir-plug's plug_cowboy occurs because the function Plug.Cowboy.Conn.conn/1 converts the client-supplied HTTP/2 :scheme pseudo-header to an atom using String.to_atom/1 without validation. Each unique :scheme value creates a new atom in the Erlang VM's atom table, which has a fixed size and does not support garbage collection. An attacker can exploit this by sending numerous HTTP/2 requests with unique :scheme values, exhausting the atom table and causing the Erlang VM to abort with a system_limit error, resulting in a denial of service. This vulnerability affects plug_cowboy versions from 2.0.0 before 2.8.1 and does not impact HTTP/1.1 where the scheme is derived differently. There is no vendor advisory or patch information currently available.

An unauthenticated remote attacker can cause a denial of service by exhausting the Erlang VM atom table through crafted HTTP/2 requests with unique :scheme pseudo-header values. This leads to the Erlang VM aborting with a system_limit error and the entire node crashing, resulting in service disruption. The vulnerability does not affect HTTP/1.1 connections. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider mitigating exposure by restricting or filtering HTTP/2 traffic from untrusted sources or disabling HTTP/2 support if feasible. Avoid relying on HTTP/2 connections from untrusted clients to prevent exploitation. Monitor vendor channels for updates and patches addressing this issue.