CVE-2026-59248
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A vulnerability in the cowlib library allows an unauthenticated remote attacker to exhaust memory on a vulnerable server or client by sending specially crafted HTTP/2 or HTTP/3 frames. The issue stems from missing limits in the HPACK and QPACK decoder, which processes arbitrarily long prefixed integers, causing large bignum allocations and heavy garbage collection churn.
Risk Assessment
An attacker can cause a denial of service (DoS) by exhausting memory in vulnerable servers and clients using cowlib, including Cowboy servers, RabbitMQ, and other Erlang/Elixir applications. Repeated or concurrent connections amplify memory pressure and can lead to complete exhaustion of the Erlang VM memory.
Recommendation
Immediately upgrade cowlib to version 2.19.0 or later. If an upgrade is not possible, restrict access to endpoints accepting HPACK/QPACK to trusted peers only.
Other vulnerabilities in cowlib
See all- CVE-2026-43970High
CVE-2026-43970 is a vulnerability related to improper handling of highly compressed data in the cowlib library, which can lead to remote denial of service attacks via memory exhaustion. It allows unauthenticated users to send specially crafted SPDY frames that can cause significant memory consumption.
- CVE-2026-43971Medium
Improper Encoding or Escaping of Output vulnerability in ninenines cowlib allows Link header directive smuggling via unescaped special characters in cow_link:link/1. cow_link:do_link/1 in cowlib interpolates the target URI, rel value, and attribute keys directly into the serialized Link: header value without escaping or token-grammar validation. A > byte in target prematurely closes the URI slot, allowing an attacker to append additional link entries with attacker-chosen rel directives. A " or \ in rel escapes the quoted string and opens new parameters. Any byte — including whitespace, =, and " — in an attribute key is emitted verbatim. Because browsers act on Link: directives such as rel="preconnect", rel="preload", and rel="prerender", an attacker who can influence these fields in an application that round-trips parsed Link headers through cow_link:link/1 can force victim browsers to make out-of-band connections to attacker-controlled origins. This issue affects cowlib: from 2.9.0 onward.
- CVE-2026-43966Medium
A CRLF injection vulnerability in cowlib version 2.9.0 allows HTTP response splitting due to improper neutralization of non-VCHAR bytes in structured HTTP header values. The escape_string/2 function fails to escape CR and LF characters, enabling attackers to inject new headers into HTTP responses.
- CVE-2026-43969Low
CRLF Injection vulnerability in cowlib allows HTTP request splitting and cookie smuggling via unvalidated cookie name and value fields. The cow_cookie:cookie/1 function builds a Cookie header without validation, allowing an attacker to inject ;, ,, CR, LF, or TAB characters.
Original NVD description (English source)
Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of service. The HPACK and QPACK prefixed-integer decoder cow_hpack_common:dec_big_int/3 in src/cow_hpack_common.hrl (invoked from cow_hpack:decode/2 in src/cow_hpack.erl and from cow_qpack:decode_field_section/3 in src/cow_qpack.erl) reads continuation octets until it sees one whose high bit is clear, evaluating Int + (Value bsl M) at each step with the shift M growing by seven per octet. No limit is enforced on the number of continuation octets, on the resulting bit width, or on the value; the decoder consumes whatever encoded length the peer supplies. Because Erlang integers are immutable, each intermediate Value bsl M and each accumulator update allocates a fresh bignum whose digit width grows linearly with the number of octets processed so far. Summed across the whole decode, the transient bignum digit materialization is on the order of the square of the encoded length. A single maximal HPACK indexed representation carried inside one HTTP/2 HEADERS plus one CONTINUATION frame at Cowboy's default max_frame_size_received can force hundreds of megabytes of transient allocation and garbage-collection churn before the resulting header-table index is rejected as invalid. Repeated or concurrent connections multiply the pressure and can drive the Erlang VM to memory exhaustion. Cowlib is the HTTP parser used by Cowboy, RabbitMQ's management plugin, and other Erlang and Elixir HTTP/2 and HTTP/3 servers and clients, so any exposed endpoint that accepts HPACK or QPACK from an untrusted peer is reachable. This issue affects cowlib: from 2.0.0 before 2.19.0.