Threats tagged 'ghsa-q8x4-x7mp-5vg2'

Plug.Cowboy versions from 2.0.0 up to but not including 2.8.1 are vulnerable to an unauthenticated remote denial-of-service attack via HTTP/2. An attacker can exhaust the Erlang VM's atom table by sending crafted HTTP/2 requests, causing the entire VM to crash. This affects applications using Plug.Cowboy with HTTP/2 enabled, including Phoenix applications if they expose HTTP/2 endpoints directly without a proxy or with certain proxy configurations. The vulnerability is fixed in version 2.8.1.