The vulnerability in cowboy (versions 2.0.0 to before 2.15.0) is due to the function cowboy_req:read_part/3 accumulating incoming request bytes into a buffer without enforcing an upper bound. When parsing multipart headers, if the request body never yields a complete header section (e.g., missing boundary delimiters or header line terminators), the server process continues to accumulate memory linearly with incoming bytes. This can be exploited by unauthenticated attackers sending crafted multipart/form-data requests to exhaust BEAM memory, causing denial of service. The issue is classified under CWE-770 (Allocation of Resources Without Limits or Throttling).

An attacker can cause a denial of service by sending multipart/form-data requests that prevent completion of header parsing, leading to unbounded memory consumption in the server process. This can exhaust the BEAM virtual machine memory, potentially causing service disruption or crashes. The vulnerability does not require authentication and can be triggered remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing external request size limits or rate limiting at the network or proxy level to mitigate potential exploitation. Monitor for unusual memory usage patterns in cowboy server processes. Avoid exposing vulnerable versions to untrusted networks if possible.