CVE-2026-59248 (GCVE-0-2026-59248)

Vulnerability from cvelistv5 – Published: 2026-07-28 09:54 – Updated: 2026-07-29 04:18
VLAI
Title
Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS
Summary
Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of service. The HPACK and QPACK prefixed-integer decoder cow_hpack_common:dec_big_int/3 in src/cow_hpack_common.hrl (invoked from cow_hpack:decode/2 in src/cow_hpack.erl and from cow_qpack:decode_field_section/3 in src/cow_qpack.erl) reads continuation octets until it sees one whose high bit is clear, evaluating Int + (Value bsl M) at each step with the shift M growing by seven per octet. No limit is enforced on the number of continuation octets, on the resulting bit width, or on the value; the decoder consumes whatever encoded length the peer supplies. Because Erlang integers are immutable, each intermediate Value bsl M and each accumulator update allocates a fresh bignum whose digit width grows linearly with the number of octets processed so far. Summed across the whole decode, the transient bignum digit materialization is on the order of the square of the encoded length. A single maximal HPACK indexed representation carried inside one HTTP/2 HEADERS plus one CONTINUATION frame at Cowboy's default max_frame_size_received can force hundreds of megabytes of transient allocation and garbage-collection churn before the resulting header-table index is rejected as invalid. Repeated or concurrent connections multiply the pressure and can drive the Erlang VM to memory exhaustion. Cowlib is the HTTP parser used by Cowboy, RabbitMQ's management plugin, and other Erlang and Elixir HTTP/2 and HTTP/3 servers and clients, so any exposed endpoint that accepts HPACK or QPACK from an untrusted peer is reachable. This issue affects cowlib: from 2.0.0 before 2.19.0.
Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
EEF
References
Impacted products
Vendor Product Version
ninenines cowlib Affected: 2.0.0-pre.1 , < 2.19.0 (semver)
    cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*
 Create a notification for this product.
ninenines cowlib Affected: 5ddecbc121f812aec53d9df91829448d8e94e44c , < f582430498072a0c65ad338030321576dc13a343 (git)
    cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*
 Create a notification for this product.
Credits
David Hernández Jonatan Männchen / EEF Loïc Hoguin Jonatan Männchen / EEF
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59248",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-28T12:39:48.662716Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-28T12:40:53.530Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "cow_hpack",
            "cow_qpack"
          ],
          "packageName": "cowlib",
          "packageURL": "pkg:hex/cowlib",
          "product": "cowlib",
          "programFiles": [
            "src/cow_hpack_common.hrl",
            "src/cow_hpack.erl",
            "src/cow_qpack.erl"
          ],
          "programRoutines": [
            {
              "name": "cow_hpack:decode/2"
            },
            {
              "name": "cow_qpack:decode_field_section/3"
            }
          ],
          "repo": "https://github.com/ninenines/cowlib",
          "vendor": "ninenines",
          "versions": [
            {
              "lessThan": "2.19.0",
              "status": "affected",
              "version": "2.0.0-pre.1",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "cow_hpack",
            "cow_qpack"
          ],
          "packageName": "ninenines/cowlib",
          "packageURL": "pkg:github/ninenines/cowlib",
          "product": "cowlib",
          "programFiles": [
            "src/cow_hpack_common.hrl",
            "src/cow_hpack.erl",
            "src/cow_qpack.erl"
          ],
          "programRoutines": [
            {
              "name": "cow_hpack:decode/2"
            },
            {
              "name": "cow_qpack:decode_field_section/3"
            }
          ],
          "repo": "https://github.com/ninenines/cowlib",
          "vendor": "ninenines",
          "versions": [
            {
              "lessThan": "f582430498072a0c65ad338030321576dc13a343",
              "status": "affected",
              "version": "5ddecbc121f812aec53d9df91829448d8e94e44c",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.19.0",
                  "versionStartIncluding": "2.0.0-pre.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "David Hern\u00e1ndez"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jonatan M\u00e4nnchen / EEF"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Lo\u00efc Hoguin"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAllocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of service.\u003c/p\u003e\u003cp\u003eThe HPACK and QPACK prefixed-integer decoder \u003ctt\u003ecow_hpack_common:dec_big_int/3\u003c/tt\u003e in \u003ctt\u003esrc/cow_hpack_common.hrl\u003c/tt\u003e (invoked from \u003ctt\u003ecow_hpack:decode/2\u003c/tt\u003e in \u003ctt\u003esrc/cow_hpack.erl\u003c/tt\u003e and from \u003ctt\u003ecow_qpack:decode_field_section/3\u003c/tt\u003e in \u003ctt\u003esrc/cow_qpack.erl\u003c/tt\u003e) reads continuation octets until it sees one whose high bit is clear, evaluating \u003ctt\u003eInt + (Value bsl M)\u003c/tt\u003e at each step with the shift \u003ctt\u003eM\u003c/tt\u003e growing by seven per octet. No limit is enforced on the number of continuation octets, on the resulting bit width, or on the value; the decoder consumes whatever encoded length the peer supplies.\u003c/p\u003e\u003cp\u003eBecause Erlang integers are immutable, each intermediate \u003ctt\u003eValue bsl M\u003c/tt\u003e and each accumulator update allocates a fresh bignum whose digit width grows linearly with the number of octets processed so far. Summed across the whole decode, the transient bignum digit materialization is on the order of the square of the encoded length. A single maximal HPACK indexed representation carried inside one HTTP/2 \u003ctt\u003eHEADERS\u003c/tt\u003e plus one \u003ctt\u003eCONTINUATION\u003c/tt\u003e frame at Cowboy\u0027s default \u003ctt\u003emax_frame_size_received\u003c/tt\u003e can force hundreds of megabytes of transient allocation and garbage-collection churn before the resulting header-table index is rejected as invalid. Repeated or concurrent connections multiply the pressure and can drive the Erlang VM to memory exhaustion.\u003c/p\u003e\u003cp\u003eCowlib is the HTTP parser used by Cowboy, RabbitMQ\u0027s management plugin, and other Erlang and Elixir HTTP/2 and HTTP/3 servers and clients, so any exposed endpoint that accepts HPACK or QPACK from an untrusted peer is reachable.\u003c/p\u003e\u003cp\u003eThis issue affects cowlib: from 2.0.0 before 2.19.0.\u003c/p\u003e"
            }
          ],
          "value": "Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of service.\n\nThe HPACK and QPACK prefixed-integer decoder cow_hpack_common:dec_big_int/3 in src/cow_hpack_common.hrl (invoked from cow_hpack:decode/2 in src/cow_hpack.erl and from cow_qpack:decode_field_section/3 in src/cow_qpack.erl) reads continuation octets until it sees one whose high bit is clear, evaluating Int + (Value bsl M) at each step with the shift M growing by seven per octet. No limit is enforced on the number of continuation octets, on the resulting bit width, or on the value; the decoder consumes whatever encoded length the peer supplies.\n\nBecause Erlang integers are immutable, each intermediate Value bsl M and each accumulator update allocates a fresh bignum whose digit width grows linearly with the number of octets processed so far. Summed across the whole decode, the transient bignum digit materialization is on the order of the square of the encoded length. A single maximal HPACK indexed representation carried inside one HTTP/2 HEADERS plus one CONTINUATION frame at Cowboy\u0027s default max_frame_size_received can force hundreds of megabytes of transient allocation and garbage-collection churn before the resulting header-table index is rejected as invalid. Repeated or concurrent connections multiply the pressure and can drive the Erlang VM to memory exhaustion.\n\nCowlib is the HTTP parser used by Cowboy, RabbitMQ\u0027s management plugin, and other Erlang and Elixir HTTP/2 and HTTP/3 servers and clients, so any exposed endpoint that accepts HPACK or QPACK from an untrusted peer is reachable.\n\nThis issue affects cowlib: from 2.0.0 before 2.19.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-130",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-130 Excessive Allocation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-29T04:18:17.483Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory",
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-59248.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-59248"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ninenines/cowlib/commit/f582430498072a0c65ad338030321576dc13a343"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-59248",
    "datePublished": "2026-07-28T09:54:19.579Z",
    "dateReserved": "2026-07-04T04:24:03.652Z",
    "dateUpdated": "2026-07-29T04:18:17.483Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-59248\",\"sourceIdentifier\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"published\":\"2026-07-28T10:16:50.083\",\"lastModified\":\"2026-07-28T13:18:58.513\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of service.\\n\\nThe HPACK and QPACK prefixed-integer decoder cow_hpack_common:dec_big_int/3 in src/cow_hpack_common.hrl (invoked from cow_hpack:decode/2 in src/cow_hpack.erl and from cow_qpack:decode_field_section/3 in src/cow_qpack.erl) reads continuation octets until it sees one whose high bit is clear, evaluating Int + (Value bsl M) at each step with the shift M growing by seven per octet. No limit is enforced on the number of continuation octets, on the resulting bit width, or on the value; the decoder consumes whatever encoded length the peer supplies.\\n\\nBecause Erlang integers are immutable, each intermediate Value bsl M and each accumulator update allocates a fresh bignum whose digit width grows linearly with the number of octets processed so far. Summed across the whole decode, the transient bignum digit materialization is on the order of the square of the encoded length. A single maximal HPACK indexed representation carried inside one HTTP/2 HEADERS plus one CONTINUATION frame at Cowboy\u0027s default max_frame_size_received can force hundreds of megabytes of transient allocation and garbage-collection churn before the resulting header-table index is rejected as invalid. Repeated or concurrent connections multiply the pressure and can drive the Erlang VM to memory exhaustion.\\n\\nCowlib is the HTTP parser used by Cowboy, RabbitMQ\u0027s management plugin, and other Erlang and Elixir HTTP/2 and HTTP/3 servers and clients, so any exposed endpoint that accepts HPACK or QPACK from an untrusted peer is reachable.\\n\\nThis issue affects cowlib: from 2.0.0 before 2.19.0.\"}],\"affected\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"affectedData\":[{\"vendor\":\"ninenines\",\"product\":\"cowlib\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://repo.hex.pm\",\"packageName\":\"cowlib\",\"cpes\":[\"cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*\"],\"modules\":[\"cow_hpack\",\"cow_qpack\"],\"programFiles\":[\"src/cow_hpack_common.hrl\",\"src/cow_hpack.erl\",\"src/cow_qpack.erl\"],\"programRoutines\":[{\"name\":\"cow_hpack:decode/2\"},{\"name\":\"cow_qpack:decode_field_section/3\"}],\"repo\":\"https://github.com/ninenines/cowlib\",\"packageURL\":\"pkg:hex/cowlib\",\"versions\":[{\"version\":\"2.0.0-pre.1\",\"lessThan\":\"2.19.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"ninenines\",\"product\":\"cowlib\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://github.com\",\"packageName\":\"ninenines/cowlib\",\"cpes\":[\"cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*\"],\"modules\":[\"cow_hpack\",\"cow_qpack\"],\"programFiles\":[\"src/cow_hpack_common.hrl\",\"src/cow_hpack.erl\",\"src/cow_qpack.erl\"],\"programRoutines\":[{\"name\":\"cow_hpack:decode/2\"},{\"name\":\"cow_qpack:decode_field_section/3\"}],\"repo\":\"https://github.com/ninenines/cowlib\",\"packageURL\":\"pkg:github/ninenines/cowlib\",\"versions\":[{\"version\":\"5ddecbc121f812aec53d9df91829448d8e94e44c\",\"lessThan\":\"f582430498072a0c65ad338030321576dc13a343\",\"versionType\":\"git\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":8.7,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-28T12:39:48.662716Z\",\"id\":\"CVE-2026-59248\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-770\"}]}],\"references\":[{\"url\":\"https://cna.erlef.org/cves/CVE-2026-59248.html\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/ninenines/cowlib/commit/f582430498072a0c65ad338030321576dc13a343\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://osv.dev/vulnerability/EEF-CVE-2026-59248\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-07-28T22:39:14+00:00",
      "cve": "CVE-2026-59248",
      "id": "CVE-2026-59248",
      "initial_release_date": "2026-07-28T09:54:19.579000+00:00",
      "product_status:fixed": "6",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "cowlib: Cowlib: Denial of Service due to unbounded HPACK/QPACK prefixed-integer decoding",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59248.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-59248\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-28T12:39:48.662716Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-28T12:40:49.783Z\"}}], \"cna\": {\"title\": \"Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"David Hern\\u00e1ndez\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Jonatan M\\u00e4nnchen / EEF\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Lo\\u00efc Hoguin\"}, {\"lang\": \"en\", \"type\": \"analyst\", \"value\": \"Jonatan M\\u00e4nnchen / EEF\"}], \"impacts\": [{\"capecId\": \"CAPEC-130\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-130 Excessive Allocation\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 8.7, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/ninenines/cowlib\", \"vendor\": \"ninenines\", \"modules\": [\"cow_hpack\", \"cow_qpack\"], \"product\": \"cowlib\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.0.0-pre.1\", \"lessThan\": \"2.19.0\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:hex/cowlib\", \"packageName\": \"cowlib\", \"programFiles\": [\"src/cow_hpack_common.hrl\", \"src/cow_hpack.erl\", \"src/cow_qpack.erl\"], \"collectionURL\": \"https://repo.hex.pm\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"cow_hpack:decode/2\"}, {\"name\": \"cow_qpack:decode_field_section/3\"}]}, {\"cpes\": [\"cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/ninenines/cowlib\", \"vendor\": \"ninenines\", \"modules\": [\"cow_hpack\", \"cow_qpack\"], \"product\": \"cowlib\", \"versions\": [{\"status\": \"affected\", \"version\": \"5ddecbc121f812aec53d9df91829448d8e94e44c\", \"lessThan\": \"f582430498072a0c65ad338030321576dc13a343\", \"versionType\": \"git\"}], \"packageURL\": \"pkg:github/ninenines/cowlib\", \"packageName\": \"ninenines/cowlib\", \"programFiles\": [\"src/cow_hpack_common.hrl\", \"src/cow_hpack.erl\", \"src/cow_qpack.erl\"], \"collectionURL\": \"https://github.com\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"cow_hpack:decode/2\"}, {\"name\": \"cow_qpack:decode_field_section/3\"}]}], \"references\": [{\"url\": \"https://cna.erlef.org/cves/CVE-2026-59248.html\", \"tags\": [\"third-party-advisory\", \"related\"]}, {\"url\": \"https://osv.dev/vulnerability/EEF-CVE-2026-59248\", \"tags\": [\"related\"]}, {\"url\": \"https://github.com/ninenines/cowlib/commit/f582430498072a0c65ad338030321576dc13a343\", \"tags\": [\"patch\"]}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of service.\\n\\nThe HPACK and QPACK prefixed-integer decoder cow_hpack_common:dec_big_int/3 in src/cow_hpack_common.hrl (invoked from cow_hpack:decode/2 in src/cow_hpack.erl and from cow_qpack:decode_field_section/3 in src/cow_qpack.erl) reads continuation octets until it sees one whose high bit is clear, evaluating Int + (Value bsl M) at each step with the shift M growing by seven per octet. No limit is enforced on the number of continuation octets, on the resulting bit width, or on the value; the decoder consumes whatever encoded length the peer supplies.\\n\\nBecause Erlang integers are immutable, each intermediate Value bsl M and each accumulator update allocates a fresh bignum whose digit width grows linearly with the number of octets processed so far. Summed across the whole decode, the transient bignum digit materialization is on the order of the square of the encoded length. A single maximal HPACK indexed representation carried inside one HTTP/2 HEADERS plus one CONTINUATION frame at Cowboy\u0027s default max_frame_size_received can force hundreds of megabytes of transient allocation and garbage-collection churn before the resulting header-table index is rejected as invalid. Repeated or concurrent connections multiply the pressure and can drive the Erlang VM to memory exhaustion.\\n\\nCowlib is the HTTP parser used by Cowboy, RabbitMQ\u0027s management plugin, and other Erlang and Elixir HTTP/2 and HTTP/3 servers and clients, so any exposed endpoint that accepts HPACK or QPACK from an untrusted peer is reachable.\\n\\nThis issue affects cowlib: from 2.0.0 before 2.19.0.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eAllocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of service.\u003c/p\u003e\u003cp\u003eThe HPACK and QPACK prefixed-integer decoder \u003ctt\u003ecow_hpack_common:dec_big_int/3\u003c/tt\u003e in \u003ctt\u003esrc/cow_hpack_common.hrl\u003c/tt\u003e (invoked from \u003ctt\u003ecow_hpack:decode/2\u003c/tt\u003e in \u003ctt\u003esrc/cow_hpack.erl\u003c/tt\u003e and from \u003ctt\u003ecow_qpack:decode_field_section/3\u003c/tt\u003e in \u003ctt\u003esrc/cow_qpack.erl\u003c/tt\u003e) reads continuation octets until it sees one whose high bit is clear, evaluating \u003ctt\u003eInt + (Value bsl M)\u003c/tt\u003e at each step with the shift \u003ctt\u003eM\u003c/tt\u003e growing by seven per octet. No limit is enforced on the number of continuation octets, on the resulting bit width, or on the value; the decoder consumes whatever encoded length the peer supplies.\u003c/p\u003e\u003cp\u003eBecause Erlang integers are immutable, each intermediate \u003ctt\u003eValue bsl M\u003c/tt\u003e and each accumulator update allocates a fresh bignum whose digit width grows linearly with the number of octets processed so far. Summed across the whole decode, the transient bignum digit materialization is on the order of the square of the encoded length. A single maximal HPACK indexed representation carried inside one HTTP/2 \u003ctt\u003eHEADERS\u003c/tt\u003e plus one \u003ctt\u003eCONTINUATION\u003c/tt\u003e frame at Cowboy\u0027s default \u003ctt\u003emax_frame_size_received\u003c/tt\u003e can force hundreds of megabytes of transient allocation and garbage-collection churn before the resulting header-table index is rejected as invalid. Repeated or concurrent connections multiply the pressure and can drive the Erlang VM to memory exhaustion.\u003c/p\u003e\u003cp\u003eCowlib is the HTTP parser used by Cowboy, RabbitMQ\u0027s management plugin, and other Erlang and Elixir HTTP/2 and HTTP/3 servers and clients, so any exposed endpoint that accepts HPACK or QPACK from an untrusted peer is reachable.\u003c/p\u003e\u003cp\u003eThis issue affects cowlib: from 2.0.0 before 2.19.0.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-770\", \"description\": \"CWE-770 Allocation of Resources Without Limits or Throttling\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"2.19.0\", \"versionStartIncluding\": \"2.0.0-pre.1\"}], \"operator\": \"OR\"}], \"operator\": \"AND\"}], \"providerMetadata\": {\"orgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"shortName\": \"EEF\", \"dateUpdated\": \"2026-07-28T09:54:19.579Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-59248\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-28T12:40:53.530Z\", \"dateReserved\": \"2026-07-04T04:24:03.652Z\", \"assignerOrgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"datePublished\": \"2026-07-28T09:54:19.579Z\", \"assignerShortName\": \"EEF\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.