CVE-2026-59248 (GCVE-0-2026-59248)
Vulnerability from cvelistv5
Published
2026-07-28 09:54
Modified
2026-07-29 04:18
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Summary
Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of service.
The HPACK and QPACK prefixed-integer decoder cow_hpack_common:dec_big_int/3 in src/cow_hpack_common.hrl (invoked from cow_hpack:decode/2 in src/cow_hpack.erl and from cow_qpack:decode_field_section/3 in src/cow_qpack.erl) reads continuation octets until it sees one whose high bit is clear, evaluating Int + (Value bsl M) at each step with the shift M growing by seven per octet. No limit is enforced on the number of continuation octets, on the resulting bit width, or on the value; the decoder consumes whatever encoded length the peer supplies.
Because Erlang integers are immutable, each intermediate Value bsl M and each accumulator update allocates a fresh bignum whose digit width grows linearly with the number of octets processed so far. Summed across the whole decode, the transient bignum digit materialization is on the order of the square of the encoded length. A single maximal HPACK indexed representation carried inside one HTTP/2 HEADERS plus one CONTINUATION frame at Cowboy's default max_frame_size_received can force hundreds of megabytes of transient allocation and garbage-collection churn before the resulting header-table index is rejected as invalid. Repeated or concurrent connections multiply the pressure and can drive the Erlang VM to memory exhaustion.
Cowlib is the HTTP parser used by Cowboy, RabbitMQ's management plugin, and other Erlang and Elixir HTTP/2 and HTTP/3 servers and clients, so any exposed endpoint that accepts HPACK or QPACK from an untrusted peer is reachable.
This issue affects cowlib: from 2.0.0 before 2.19.0.
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59248",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T12:39:48.662716Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:40:53.530Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"cow_hpack",
"cow_qpack"
],
"packageName": "cowlib",
"packageURL": "pkg:hex/cowlib",
"product": "cowlib",
"programFiles": [
"src/cow_hpack_common.hrl",
"src/cow_hpack.erl",
"src/cow_qpack.erl"
],
"programRoutines": [
{
"name": "cow_hpack:decode/2"
},
{
"name": "cow_qpack:decode_field_section/3"
}
],
"repo": "https://github.com/ninenines/cowlib",
"vendor": "ninenines",
"versions": [
{
"lessThan": "2.19.0",
"status": "affected",
"version": "2.0.0-pre.1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"cow_hpack",
"cow_qpack"
],
"packageName": "ninenines/cowlib",
"packageURL": "pkg:github/ninenines/cowlib",
"product": "cowlib",
"programFiles": [
"src/cow_hpack_common.hrl",
"src/cow_hpack.erl",
"src/cow_qpack.erl"
],
"programRoutines": [
{
"name": "cow_hpack:decode/2"
},
{
"name": "cow_qpack:decode_field_section/3"
}
],
"repo": "https://github.com/ninenines/cowlib",
"vendor": "ninenines",
"versions": [
{
"lessThan": "f582430498072a0c65ad338030321576dc13a343",
"status": "affected",
"version": "5ddecbc121f812aec53d9df91829448d8e94e44c",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.19.0",
"versionStartIncluding": "2.0.0-pre.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "David Hern\u00e1ndez"
},
{
"lang": "en",
"type": "reporter",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Lo\u00efc Hoguin"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAllocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of service.\u003c/p\u003e\u003cp\u003eThe HPACK and QPACK prefixed-integer decoder \u003ctt\u003ecow_hpack_common:dec_big_int/3\u003c/tt\u003e in \u003ctt\u003esrc/cow_hpack_common.hrl\u003c/tt\u003e (invoked from \u003ctt\u003ecow_hpack:decode/2\u003c/tt\u003e in \u003ctt\u003esrc/cow_hpack.erl\u003c/tt\u003e and from \u003ctt\u003ecow_qpack:decode_field_section/3\u003c/tt\u003e in \u003ctt\u003esrc/cow_qpack.erl\u003c/tt\u003e) reads continuation octets until it sees one whose high bit is clear, evaluating \u003ctt\u003eInt + (Value bsl M)\u003c/tt\u003e at each step with the shift \u003ctt\u003eM\u003c/tt\u003e growing by seven per octet. No limit is enforced on the number of continuation octets, on the resulting bit width, or on the value; the decoder consumes whatever encoded length the peer supplies.\u003c/p\u003e\u003cp\u003eBecause Erlang integers are immutable, each intermediate \u003ctt\u003eValue bsl M\u003c/tt\u003e and each accumulator update allocates a fresh bignum whose digit width grows linearly with the number of octets processed so far. Summed across the whole decode, the transient bignum digit materialization is on the order of the square of the encoded length. A single maximal HPACK indexed representation carried inside one HTTP/2 \u003ctt\u003eHEADERS\u003c/tt\u003e plus one \u003ctt\u003eCONTINUATION\u003c/tt\u003e frame at Cowboy\u0027s default \u003ctt\u003emax_frame_size_received\u003c/tt\u003e can force hundreds of megabytes of transient allocation and garbage-collection churn before the resulting header-table index is rejected as invalid. Repeated or concurrent connections multiply the pressure and can drive the Erlang VM to memory exhaustion.\u003c/p\u003e\u003cp\u003eCowlib is the HTTP parser used by Cowboy, RabbitMQ\u0027s management plugin, and other Erlang and Elixir HTTP/2 and HTTP/3 servers and clients, so any exposed endpoint that accepts HPACK or QPACK from an untrusted peer is reachable.\u003c/p\u003e\u003cp\u003eThis issue affects cowlib: from 2.0.0 before 2.19.0.\u003c/p\u003e"
}
],
"value": "Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of service.\n\nThe HPACK and QPACK prefixed-integer decoder cow_hpack_common:dec_big_int/3 in src/cow_hpack_common.hrl (invoked from cow_hpack:decode/2 in src/cow_hpack.erl and from cow_qpack:decode_field_section/3 in src/cow_qpack.erl) reads continuation octets until it sees one whose high bit is clear, evaluating Int + (Value bsl M) at each step with the shift M growing by seven per octet. No limit is enforced on the number of continuation octets, on the resulting bit width, or on the value; the decoder consumes whatever encoded length the peer supplies.\n\nBecause Erlang integers are immutable, each intermediate Value bsl M and each accumulator update allocates a fresh bignum whose digit width grows linearly with the number of octets processed so far. Summed across the whole decode, the transient bignum digit materialization is on the order of the square of the encoded length. A single maximal HPACK indexed representation carried inside one HTTP/2 HEADERS plus one CONTINUATION frame at Cowboy\u0027s default max_frame_size_received can force hundreds of megabytes of transient allocation and garbage-collection churn before the resulting header-table index is rejected as invalid. Repeated or concurrent connections multiply the pressure and can drive the Erlang VM to memory exhaustion.\n\nCowlib is the HTTP parser used by Cowboy, RabbitMQ\u0027s management plugin, and other Erlang and Elixir HTTP/2 and HTTP/3 servers and clients, so any exposed endpoint that accepts HPACK or QPACK from an untrusted peer is reachable.\n\nThis issue affects cowlib: from 2.0.0 before 2.19.0."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T04:18:17.483Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"third-party-advisory",
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-59248.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-59248"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ninenines/cowlib/commit/f582430498072a0c65ad338030321576dc13a343"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-59248",
"datePublished": "2026-07-28T09:54:19.579Z",
"dateReserved": "2026-07-04T04:24:03.652Z",
"dateUpdated": "2026-07-29T04:18:17.483Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-59248\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-28T12:39:48.662716Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-28T12:40:49.783Z\"}}], \"cna\": {\"title\": \"Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"David Hern\\u00e1ndez\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Jonatan M\\u00e4nnchen / EEF\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Lo\\u00efc Hoguin\"}, {\"lang\": \"en\", \"type\": \"analyst\", \"value\": \"Jonatan M\\u00e4nnchen / EEF\"}], \"impacts\": [{\"capecId\": \"CAPEC-130\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-130 Excessive Allocation\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 8.7, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/ninenines/cowlib\", \"vendor\": \"ninenines\", \"modules\": [\"cow_hpack\", \"cow_qpack\"], \"product\": \"cowlib\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.0.0-pre.1\", \"lessThan\": \"2.19.0\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:hex/cowlib\", \"packageName\": \"cowlib\", \"programFiles\": [\"src/cow_hpack_common.hrl\", \"src/cow_hpack.erl\", \"src/cow_qpack.erl\"], \"collectionURL\": \"https://repo.hex.pm\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"cow_hpack:decode/2\"}, {\"name\": \"cow_qpack:decode_field_section/3\"}]}, {\"cpes\": [\"cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/ninenines/cowlib\", \"vendor\": \"ninenines\", \"modules\": [\"cow_hpack\", \"cow_qpack\"], \"product\": \"cowlib\", \"versions\": [{\"status\": \"affected\", \"version\": \"5ddecbc121f812aec53d9df91829448d8e94e44c\", \"lessThan\": \"f582430498072a0c65ad338030321576dc13a343\", \"versionType\": \"git\"}], \"packageURL\": \"pkg:github/ninenines/cowlib\", \"packageName\": \"ninenines/cowlib\", \"programFiles\": [\"src/cow_hpack_common.hrl\", \"src/cow_hpack.erl\", \"src/cow_qpack.erl\"], \"collectionURL\": \"https://github.com\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"cow_hpack:decode/2\"}, {\"name\": \"cow_qpack:decode_field_section/3\"}]}], \"references\": [{\"url\": \"https://cna.erlef.org/cves/CVE-2026-59248.html\", \"tags\": [\"third-party-advisory\", \"related\"]}, {\"url\": \"https://osv.dev/vulnerability/EEF-CVE-2026-59248\", \"tags\": [\"related\"]}, {\"url\": \"https://github.com/ninenines/cowlib/commit/f582430498072a0c65ad338030321576dc13a343\", \"tags\": [\"patch\"]}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of service.\\n\\nThe HPACK and QPACK prefixed-integer decoder cow_hpack_common:dec_big_int/3 in src/cow_hpack_common.hrl (invoked from cow_hpack:decode/2 in src/cow_hpack.erl and from cow_qpack:decode_field_section/3 in src/cow_qpack.erl) reads continuation octets until it sees one whose high bit is clear, evaluating Int + (Value bsl M) at each step with the shift M growing by seven per octet. No limit is enforced on the number of continuation octets, on the resulting bit width, or on the value; the decoder consumes whatever encoded length the peer supplies.\\n\\nBecause Erlang integers are immutable, each intermediate Value bsl M and each accumulator update allocates a fresh bignum whose digit width grows linearly with the number of octets processed so far. Summed across the whole decode, the transient bignum digit materialization is on the order of the square of the encoded length. A single maximal HPACK indexed representation carried inside one HTTP/2 HEADERS plus one CONTINUATION frame at Cowboy\u0027s default max_frame_size_received can force hundreds of megabytes of transient allocation and garbage-collection churn before the resulting header-table index is rejected as invalid. Repeated or concurrent connections multiply the pressure and can drive the Erlang VM to memory exhaustion.\\n\\nCowlib is the HTTP parser used by Cowboy, RabbitMQ\u0027s management plugin, and other Erlang and Elixir HTTP/2 and HTTP/3 servers and clients, so any exposed endpoint that accepts HPACK or QPACK from an untrusted peer is reachable.\\n\\nThis issue affects cowlib: from 2.0.0 before 2.19.0.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eAllocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of service.\u003c/p\u003e\u003cp\u003eThe HPACK and QPACK prefixed-integer decoder \u003ctt\u003ecow_hpack_common:dec_big_int/3\u003c/tt\u003e in \u003ctt\u003esrc/cow_hpack_common.hrl\u003c/tt\u003e (invoked from \u003ctt\u003ecow_hpack:decode/2\u003c/tt\u003e in \u003ctt\u003esrc/cow_hpack.erl\u003c/tt\u003e and from \u003ctt\u003ecow_qpack:decode_field_section/3\u003c/tt\u003e in \u003ctt\u003esrc/cow_qpack.erl\u003c/tt\u003e) reads continuation octets until it sees one whose high bit is clear, evaluating \u003ctt\u003eInt + (Value bsl M)\u003c/tt\u003e at each step with the shift \u003ctt\u003eM\u003c/tt\u003e growing by seven per octet. No limit is enforced on the number of continuation octets, on the resulting bit width, or on the value; the decoder consumes whatever encoded length the peer supplies.\u003c/p\u003e\u003cp\u003eBecause Erlang integers are immutable, each intermediate \u003ctt\u003eValue bsl M\u003c/tt\u003e and each accumulator update allocates a fresh bignum whose digit width grows linearly with the number of octets processed so far. Summed across the whole decode, the transient bignum digit materialization is on the order of the square of the encoded length. A single maximal HPACK indexed representation carried inside one HTTP/2 \u003ctt\u003eHEADERS\u003c/tt\u003e plus one \u003ctt\u003eCONTINUATION\u003c/tt\u003e frame at Cowboy\u0027s default \u003ctt\u003emax_frame_size_received\u003c/tt\u003e can force hundreds of megabytes of transient allocation and garbage-collection churn before the resulting header-table index is rejected as invalid. Repeated or concurrent connections multiply the pressure and can drive the Erlang VM to memory exhaustion.\u003c/p\u003e\u003cp\u003eCowlib is the HTTP parser used by Cowboy, RabbitMQ\u0027s management plugin, and other Erlang and Elixir HTTP/2 and HTTP/3 servers and clients, so any exposed endpoint that accepts HPACK or QPACK from an untrusted peer is reachable.\u003c/p\u003e\u003cp\u003eThis issue affects cowlib: from 2.0.0 before 2.19.0.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-770\", \"description\": \"CWE-770 Allocation of Resources Without Limits or Throttling\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"2.19.0\", \"versionStartIncluding\": \"2.0.0-pre.1\"}], \"operator\": \"OR\"}], \"operator\": \"AND\"}], \"providerMetadata\": {\"orgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"shortName\": \"EEF\", \"dateUpdated\": \"2026-07-29T04:18:17.483Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-59248\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-29T04:18:17.483Z\", \"dateReserved\": \"2026-07-04T04:24:03.652Z\", \"assignerOrgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"datePublished\": \"2026-07-28T09:54:19.579Z\", \"assignerShortName\": \"EEF\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…