Threats affecting pkg:github/vshakitskiy/ewe

ewe is a Gleam web server. Prior to version 3.0.6, the encode_headers function in src/ewe/internal/encoder.gleam directly interpolates response header keys and values into raw HTTP bytes without validating or stripping CRLF (\r\n) sequences. An application that passes user-controlled data into response headers (e.g., setting a Location redirect header from a request parameter) allows an attacker to inject arbitrary HTTP response content, leading to response splitting, cache poisoning, and possible cross-site scripting. Notably, ewe does validate CRLF in incoming request headers via validate_field_value() in the HTTP/1.1 parser — but provides no equivalent protection for outgoing response headers in the encoder. This issue has been patched in version 3.0.6.

CVE-2026-32881 affects the Gleam web server 'ewe' versions 0.6.0 through 3.0.4 and allows attackers to bypass authentication or spoof proxy-trust headers by exploiting permissive handling of chunked transfer encoding trailers. The vulnerability arises because only a limited denylist of nine header names is blocked when merging trailer headers into the request headers after body parsing. Malicious clients can append headers in the Trailer field after the final chunk, causing legitimate headers to be overwritten. This enables forging authentication credentials, session hijacking, bypassing IP-based rate limiting, or spoofing proxy-trust headers in downstream middleware that reads headers post body parsing. The issue is fixed in version 3.0.

CVE-2026-32873 is a high-severity vulnerability in the Gleam web server 'ewe' versions 0.8.0 through 3.0.4. The flaw exists in the handle_trailers function, where rejected trailer headers cause an infinite recursion loop, leading to 100% CPU usage and a denial-of-service condition. This occurs because the function repeatedly re-parses the same header without advancing, permanently wedging the BEAM process. Exploitation requires no authentication or user interaction and can be triggered remotely via chunked HTTP requests. The vulnerability is fixed in version 3.0.