AIKIDO-2026-478480

TL;DR

cowboy_http enforces max_headers by counting distinct header names in a map (maps:size(Headers)). Duplicate header lines with the same name are concatenated into one map entry (", " for normal headers, "; " for cookies), so the map size never grows and the default max_headers cap is never hit. With only per-line name/value length limits and no bound on total header-line count or header-block size, an unauthenticated HTTP/1.1 client can send many duplicate-name lines and grow the connection process binary heap until request_timeout or, if unset, drive the Erlang VM toward out-of-memory. The fix counts header lines (including duplicates) toward max_headers so the limit cannot be bypassed.