Migrating from Cowboy 2.14 to 2.15

Cowboy 2.15 fixes a number of security vulnerabilities. It also has a few new options for HTTP/1.1.

Cowboy 2.15 updates Cowlib to 2.16.1. Both applications must be updated as they both contain security fixes.

Cowboy 2.15 requires Erlang/OTP 24.0 or greater.

Features added

• The max_authorization_header_value_length and max_cookie_header_value_length options were added to HTTP/1.1. They allow more fine-grained control over header value lengths.

Bugs fixed

• A number of security vulnerabilities have been fixed, including a possible denial of service in the HTTP/1.1 parser.
• Update Cowlib to 2.16.1.
• HTTP/2 Websocket did not call terminate/3 on abrupt socket close (without a close frame being sent first). This is now fixed. Do note however that the Websocket session process must trap exits to call terminate/3. This was fixed since Cowboy 2.14.1.