CVE-2026-32873 ewe: Loop with Unreachable Exit Condition ('Infinite Loop')
Remote attackers can cause a permanent CPU exhaustion denial of service in applications using this Gleam web server library by sending malformed chunked requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32873?
CVE-2026-32873 is a high-severity denial of service vulnerability in vshakitskiy ewe, published on 20 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ewe is a Gleam web server. Versions 0.8.0 through 3.0.4 contain a bug in the handle_trailers function where rejected trailer headers (forbidden or undeclared) cause an infinite loop. When handle_trailers encounters such a trailer, three code paths (lines 520, 523, 526) recurse with the original buffer (rest) instead of advancing past the rejected header (Buffer(header_rest, 0)), causing decoder.decode_packet to re-parse the same header on every iteration. The resulting loop has no timeout or escape — the BEAM process permanently wedges at 100% CPU. Any application that calls ewe.read_body on chunked requests is affected, and this is exploitable by any unauthenticated remote client before control returns to application code, making an application-level workaround impossible. This issue is fixed in version 3.0.5.
Which versions are affected by CVE-2026-32873?
2 open source packages ship an affected version, including ewe. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ewe Hex | From 0.8.0 | 3.0.5 |
ewe Hex | From 0.8.0 | 3.0.5 |
Products include Vshakitskiy Ewe.
How do I fix CVE-2026-32873?
Upgrade ewe to 3.0.5 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-32873 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32873 exists.
Other vulnerabilities in vshakitskiy ewe
Sources
Also known as GHSA-4w98-xf39-23gp.