CVE-2026-32688

This CVE affects elixir-plug plug_cowboy: Plug.Cowboy.Conn.conn/1 calls String.to_atom/1 on the value from :cowboy_req.scheme/1. For HTTP/2, the scheme header is client-supplied and passed verbatim by cowlib, creating a new BEAM atom per unique value. Atoms are not garbage-collected and the atom ...