cowboy (Hex)

Advisories

Latest version

—

License

—

OpenSSF Scorecard

—

How to fix

Upgrading to 2.18.0 or later clears every advisory below that has a fix.

Upgrade commands

mix

{:cowboy, "~> 2.18.0"} # then: mix deps.update cowboy

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
EEF-CVE-2026-65624 Cowboy HTTP/1.1 max_headers Bypass via Duplicate Header Names Enables Memory Exhaustion	Not rated yet EPSS 0.38%	`>= 2.0.0-pre.4, < 2.18.0`	`2.18.0`
EEF-CVE-2026-43966 HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2	Medium EPSS 0.26%	`< 2.16.0`	`2.16.0`
GHSA-jfc2-q6qh-g5x8 Unbounded buffer accumulation in multipart header parsing causes denial of service in cowboy	High EPSS 0.38%	`>= 2.0.0, < 2.15.0`	`2.15.0`
GHSA-jfc2-q6qh-g5x8 Unbounded buffer accumulation in multipart header parsing causes denial of service in cowboy	High EPSS 0.38%	`>= 2.0.0, < 2.15.0`	`2.15.0`

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor