The vulnerability arises because cowboy_http enforces the max_headers limit by counting distinct header names in a map. When multiple headers share the same name, their values are concatenated into a single binary under one map key, so the map size does not increase and the max_headers limit is never triggered. There is no limit on the total number of header lines or the total byte size of the header block, only per-line limits. An attacker can send an arbitrary number of headers with the same name, causing the connection process's memory usage to grow arbitrarily large within the request timeout window. If max_heap_size is unset (default), sustained exploitation can cause the Erlang VM to run out of memory. The affected versions are cowboy from 2.0.0-pre.4 before 2.18.0.

An unauthenticated remote attacker can cause a denial of service by exhausting memory resources on the server running cowboy. This can lead to the Erlang VM running out of memory and potentially crashing or becoming unresponsive. The impact is limited per connection by the request timeout and optionally by max_heap_size if configured. Without max_heap_size set, the server is vulnerable to sustained memory exhaustion attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should verify if a fixed version is available beyond 2.18.0 or if configuration options like max_heap_size can be set to limit memory usage per connection. Until an official fix is released, setting max_heap_size to a reasonable limit may mitigate the impact by killing offending connection processes before exhausting system memory.