Skip to content
OpenAdvisories

Package · Hex

cowlib

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.7
    CVE-2026-113431

    Unbounded decoded HTTP/2 header-list size in cowlib cow_http2_machine enables HPACK amplification memory exhaustion

    Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowlib allows an unauthenticated remote peer to exhaust the memory of an HTTP/2 endpoint via HPACK-indexed header fields. cow_http2_machine:headers_decode/4 in src/cow_http2_machi…

    ninenines cowlib cowlib erlang-cowlib Ubuntu Hex
  • High 8.7
    CVE-2026-59248 Public exploit

    Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS

    Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of service. The HPACK and QPACK prefixed-integer decoder …

    ninenines cowlib rabbitmq-server cowlib Debian Ubuntu Hex
  • High 8.2
    CVE-2026-43970

    Decompression Bomb in cow_spdy:inflate/2 Allows Memory Exhaustion via Crafted SPDY Frame

    Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenines cowlib allows unauthenticated remote denial of service via memory exhaustion. cow_spdy:inflate/2 in cowlib passes peer-supplied compressed bytes directly to zlib:infla…

    ninenines cowlib cowlib erlang-cowlib Debian Ubuntu Hex
  • High 8.7
    CVE-2026-7790

    Unbounded chunk-size hex digits in cowlib cause quadratic CPU and memory DoS

    Uncontrolled Resource Consumption vulnerability in ninenines cowlib (cow_http_te module) allows Excessive Allocation. The chunked transfer-encoding parser in cow_http_te accepts an unbounded number of hex digits in the chunk-size field. Each digit causes a bi…

    ninenines cowlib cowlib erlang-cowlib Debian Ubuntu Hex