Vulnerability-Lookup

CVE-2026-59248 (GCVE-0-2026-59248)

Vulnerability from cvelistv5 – Published: 2026-07-28 09:54 – Updated: 2026-07-29 04:18

Title

Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS

Summary

Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of service. The HPACK and QPACK prefixed-integer decoder cow_hpack_common:dec_big_int/3 in src/cow_hpack_common.hrl (invoked from cow_hpack:decode/2 in src/cow_hpack.erl and from cow_qpack:decode_field_section/3 in src/cow_qpack.erl) reads continuation octets until it sees one whose high bit is clear, evaluating Int + (Value bsl M) at each step with the shift M growing by seven per octet. No limit is enforced on the number of continuation octets, on the resulting bit width, or on the value; the decoder consumes whatever encoded length the peer supplies. Because Erlang integers are immutable, each intermediate Value bsl M and each accumulator update allocates a fresh bignum whose digit width grows linearly with the number of octets processed so far. Summed across the whole decode, the transient bignum digit materialization is on the order of the square of the encoded length. A single maximal HPACK indexed representation carried inside one HTTP/2 HEADERS plus one CONTINUATION frame at Cowboy's default max_frame_size_received can force hundreds of megabytes of transient allocation and garbage-collection churn before the resulting header-table index is rejected as invalid. Repeated or concurrent connections multiply the pressure and can drive the Erlang VM to memory exhaustion. Cowlib is the HTTP parser used by Cowboy, RabbitMQ's management plugin, and other Erlang and Elixir HTTP/2 and HTTP/3 servers and clients, so any exposed endpoint that accepts HPACK or QPACK from an untrusted peer is reachable. This issue affects cowlib: from 2.0.0 before 2.19.0.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-28 12:39 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

EEF CNA under the mitre root

CNA scorecard A 97/100 over 353 records in the last 180 days details

References

3 references

URL	Tags
https://cna.erlef.org/cves/CVE-2026-59248.html	third-party-advisoryrelated
https://osv.dev/vulnerability/EEF-CVE-2026-59248	related
https://github.com/ninenines/cowlib/commit/f58243…	patch

Impacted products

2 products

Vendor	Product	Version	CPE status
ninenines	cowlib	Affected: 2.0.0-pre.1 , < 2.19.0 (semver) cpe:2.3:a:ninenines:cowlib::::::::
ninenines	cowlib	Affected: 5ddecbc121f812aec53d9df91829448d8e94e44c , < f582430498072a0c65ad338030321576dc13a343 (git) cpe:2.3:a:ninenines:cowlib::::::::

Credits

David Hernández Jonatan Männchen / EEF Loïc Hoguin Jonatan Männchen / EEF

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59248",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-28T12:39:48.662716Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-28T12:40:53.530Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "cow_hpack",
            "cow_qpack"
          ],
          "packageName": "cowlib",
          "packageURL": "pkg:hex/cowlib",
          "product": "cowlib",
          "programFiles": [
            "src/cow_hpack_common.hrl",
            "src/cow_hpack.erl",
            "src/cow_qpack.erl"
          ],
          "programRoutines": [
            {
              "name": "cow_hpack:decode/2"
            },
            {
              "name": "cow_qpack:decode_field_section/3"
            }
          ],
          "repo": "https://github.com/ninenines/cowlib",
          "vendor": "ninenines",
          "versions": [
            {
              "lessThan": "2.19.0",
              "status": "affected",
              "version": "2.0.0-pre.1",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "cow_hpack",
            "cow_qpack"
          ],
          "packageName": "ninenines/cowlib",
          "packageURL": "pkg:github/ninenines/cowlib",
          "product": "cowlib",
          "programFiles": [
            "src/cow_hpack_common.hrl",
            "src/cow_hpack.erl",
            "src/cow_qpack.erl"
          ],
          "programRoutines": [
            {
              "name": "cow_hpack:decode/2"
            },
            {
              "name": "cow_qpack:decode_field_section/3"
            }
          ],
          "repo": "https://github.com/ninenines/cowlib",
          "vendor": "ninenines",
          "versions": [
            {
              "lessThan": "f582430498072a0c65ad338030321576dc13a343",
              "status": "affected",
              "version": "5ddecbc121f812aec53d9df91829448d8e94e44c",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.19.0",
                  "versionStartIncluding": "2.0.0-pre.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "David Hern\u00e1ndez"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jonatan M\u00e4nnchen / EEF"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Lo\u00efc Hoguin"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAllocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of service.\u003c/p\u003e\u003cp\u003eThe HPACK and QPACK prefixed-integer decoder \u003ctt\u003ecow_hpack_common:dec_big_int/3\u003c/tt\u003e in \u003ctt\u003esrc/cow_hpack_common.hrl\u003c/tt\u003e (invoked from \u003ctt\u003ecow_hpack:decode/2\u003c/tt\u003e in \u003ctt\u003esrc/cow_hpack.erl\u003c/tt\u003e and from \u003ctt\u003ecow_qpack:decode_field_section/3\u003c/tt\u003e in \u003ctt\u003esrc/cow_qpack.erl\u003c/tt\u003e) reads continuation octets until it sees one whose high bit is clear, evaluating \u003ctt\u003eInt + (Value bsl M)\u003c/tt\u003e at each step with the shift \u003ctt\u003eM\u003c/tt\u003e growing by seven per octet. No limit is enforced on the number of continuation octets, on the resulting bit width, or on the value; the decoder consumes whatever encoded length the peer supplies.\u003c/p\u003e\u003cp\u003eBecause Erlang integers are immutable, each intermediate \u003ctt\u003eValue bsl M\u003c/tt\u003e and each accumulator update allocates a fresh bignum whose digit width grows linearly with the number of octets processed so far. Summed across the whole decode, the transient bignum digit materialization is on the order of the square of the encoded length. A single maximal HPACK indexed representation carried inside one HTTP/2 \u003ctt\u003eHEADERS\u003c/tt\u003e plus one \u003ctt\u003eCONTINUATION\u003c/tt\u003e frame at Cowboy\u0027s default \u003ctt\u003emax_frame_size_received\u003c/tt\u003e can force hundreds of megabytes of transient allocation and garbage-collection churn before the resulting header-table index is rejected as invalid. Repeated or concurrent connections multiply the pressure and can drive the Erlang VM to memory exhaustion.\u003c/p\u003e\u003cp\u003eCowlib is the HTTP parser used by Cowboy, RabbitMQ\u0027s management plugin, and other Erlang and Elixir HTTP/2 and HTTP/3 servers and clients, so any exposed endpoint that accepts HPACK or QPACK from an untrusted peer is reachable.\u003c/p\u003e\u003cp\u003eThis issue affects cowlib: from 2.0.0 before 2.19.0.\u003c/p\u003e"
            }
          ],
          "value": "Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of service.\n\nThe HPACK and QPACK prefixed-integer decoder cow_hpack_common:dec_big_int/3 in src/cow_hpack_common.hrl (invoked from cow_hpack:decode/2 in src/cow_hpack.erl and from cow_qpack:decode_field_section/3 in src/cow_qpack.erl) reads continuation octets until it sees one whose high bit is clear, evaluating Int + (Value bsl M) at each step with the shift M growing by seven per octet. No limit is enforced on the number of continuation octets, on the resulting bit width, or on the value; the decoder consumes whatever encoded length the peer supplies.\n\nBecause Erlang integers are immutable, each intermediate Value bsl M and each accumulator update allocates a fresh bignum whose digit width grows linearly with the number of octets processed so far. Summed across the whole decode, the transient bignum digit materialization is on the order of the square of the encoded length. A single maximal HPACK indexed representation carried inside one HTTP/2 HEADERS plus one CONTINUATION frame at Cowboy\u0027s default max_frame_size_received can force hundreds of megabytes of transient allocation and garbage-collection churn before the resulting header-table index is rejected as invalid. Repeated or concurrent connections multiply the pressure and can drive the Erlang VM to memory exhaustion.\n\nCowlib is the HTTP parser used by Cowboy, RabbitMQ\u0027s management plugin, and other Erlang and Elixir HTTP/2 and HTTP/3 servers and clients, so any exposed endpoint that accepts HPACK or QPACK from an untrusted peer is reachable.\n\nThis issue affects cowlib: from 2.0.0 before 2.19.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-130",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-130 Excessive Allocation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-29T04:18:17.483Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory",
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-59248.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-59248"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ninenines/cowlib/commit/f582430498072a0c65ad338030321576dc13a343"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-59248",
    "datePublished": "2026-07-28T09:54:19.579Z",
    "dateReserved": "2026-07-04T04:24:03.652Z",
    "dateUpdated": "2026-07-29T04:18:17.483Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-59248",
      "date": "2026-11-05",
      "epss": "0.00292",
      "percentile": "0.21865"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-13T01:45:45.000Z",
      "cve": "CVE-2026-59248",
      "id": "msrc_CVE-2026-59248",
      "initial_release_date": "2026-08-07T00:56:20.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-59248.json",
      "version": "3"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://repo.hex.pm",
                "cpes": [
                  "cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "modules": [
                  "cow_hpack",
                  "cow_qpack"
                ],
                "packageName": "cowlib",
                "packageURL": "pkg:hex/cowlib",
                "product": "cowlib",
                "programFiles": [
                  "src/cow_hpack_common.hrl",
                  "src/cow_hpack.erl",
                  "src/cow_qpack.erl"
                ],
                "programRoutines": [
                  {
                    "name": "cow_hpack:decode/2"
                  },
                  {
                    "name": "cow_qpack:decode_field_section/3"
                  }
                ],
                "repo": "https://github.com/ninenines/cowlib",
                "vendor": "ninenines",
                "versions": [
                  {
                    "lessThan": "2.19.0",
                    "status": "affected",
                    "version": "2.0.0-pre.1",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "collectionURL": "https://github.com",
                "cpes": [
                  "cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "modules": [
                  "cow_hpack",
                  "cow_qpack"
                ],
                "packageName": "ninenines/cowlib",
                "packageURL": "pkg:github/ninenines/cowlib",
                "product": "cowlib",
                "programFiles": [
                  "src/cow_hpack_common.hrl",
                  "src/cow_hpack.erl",
                  "src/cow_qpack.erl"
                ],
                "programRoutines": [
                  {
                    "name": "cow_hpack:decode/2"
                  },
                  {
                    "name": "cow_qpack:decode_field_section/3"
                  }
                ],
                "repo": "https://github.com/ninenines/cowlib",
                "vendor": "ninenines",
                "versions": [
                  {
                    "lessThan": "f582430498072a0c65ad338030321576dc13a343",
                    "status": "affected",
                    "version": "5ddecbc121f812aec53d9df91829448d8e94e44c",
                    "versionType": "git"
                  }
                ]
              }
            ],
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of service.\n\nThe HPACK and QPACK prefixed-integer decoder cow_hpack_common:dec_big_int/3 in src/cow_hpack_common.hrl (invoked from cow_hpack:decode/2 in src/cow_hpack.erl and from cow_qpack:decode_field_section/3 in src/cow_qpack.erl) reads continuation octets until it sees one whose high bit is clear, evaluating Int + (Value bsl M) at each step with the shift M growing by seven per octet. No limit is enforced on the number of continuation octets, on the resulting bit width, or on the value; the decoder consumes whatever encoded length the peer supplies.\n\nBecause Erlang integers are immutable, each intermediate Value bsl M and each accumulator update allocates a fresh bignum whose digit width grows linearly with the number of octets processed so far. Summed across the whole decode, the transient bignum digit materialization is on the order of the square of the encoded length. A single maximal HPACK indexed representation carried inside one HTTP/2 HEADERS plus one CONTINUATION frame at Cowboy\u0027s default max_frame_size_received can force hundreds of megabytes of transient allocation and garbage-collection churn before the resulting header-table index is rejected as invalid. Repeated or concurrent connections multiply the pressure and can drive the Erlang VM to memory exhaustion.\n\nCowlib is the HTTP parser used by Cowboy, RabbitMQ\u0027s management plugin, and other Erlang and Elixir HTTP/2 and HTTP/3 servers and clients, so any exposed endpoint that accepts HPACK or QPACK from an untrusted peer is reachable.\n\nThis issue affects cowlib: from 2.0.0 before 2.19.0."
          },
          {
            "lang": "es",
            "value": "La vulnerabilidad de asignaci\u00f3n de recursos sin l\u00edmites en ninenines cowlib permite que un par HTTP/2 o HTTP/3 remoto no autenticado agote la memoria en el servidor (o cliente) vulnerable y cause una denegaci\u00f3n de servicio.\n\nEl decodificador de enteros con prefijo HPACK y QPACK cow_hpack_common:dec_big_int/3 en src/cow_hpack_common.hrl (invocado desde cow_hpack:decode/2 en src/cow_hpack.erl y desde cow_qpack:decode_field_section/3 en src/cow_qpack.erl) lee octetos de continuaci\u00f3n hasta que ve uno cuyo bit m\u00e1s significativo est\u00e1 claro, evaluando Int + (Value bsl M) en cada paso con el desplazamiento M creciendo en siete por octeto. No se impone ning\u00fan l\u00edmite en el n\u00famero de octetos de continuaci\u00f3n, en el ancho de bits resultante o en el valor; el decodificador consume cualquier longitud codificada que el par suministre.\n\nDebido a que los enteros de Erlang son inmutables, cada Value bsl M intermedio y cada actualizaci\u00f3n del acumulador asigna un nuevo bignum cuyo ancho de d\u00edgito crece linealmente con el n\u00famero de octetos procesados hasta ahora. Sumado a lo largo de toda la decodificaci\u00f3n, la materializaci\u00f3n transitoria de d\u00edgitos bignum es del orden del cuadrado de la longitud codificada. Una \u00fanica representaci\u00f3n indexada HPACK m\u00e1xima transportada dentro de un frame HTTP/2 HEADERS m\u00e1s un frame CONTINUATION en el max_frame_size_received predeterminado de Cowboy puede forzar cientos de megabytes de asignaci\u00f3n transitoria y agitaci\u00f3n de recolecci\u00f3n de basura antes de que el \u00edndice de la tabla de encabezados resultante sea rechazado como inv\u00e1lido. Las conexiones repetidas o concurrentes multiplican la presi\u00f3n y pueden llevar a la VM de Erlang al agotamiento de la memoria.\n\nCowlib es el analizador HTTP utilizado por Cowboy, el plugin de gesti\u00f3n de RabbitMQ, y otros servidores y clientes HTTP/2 y HTTP/3 de Erlang y Elixir, por lo que cualquier punto final expuesto que acepte HPACK o QPACK de un par no confiable es alcanzable.\n\nEste problema afecta a cowlib: desde 2.0.0 antes de 2.19.0."
          }
        ],
        "id": "CVE-2026-59248",
        "lastModified": "2026-10-24T13:10:00.147",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-59248",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-28T12:39:48.662716Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-07-28T10:16:50.083",
        "references": [
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://cna.erlef.org/cves/CVE-2026-59248.html"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://github.com/ninenines/cowlib/commit/f582430498072a0c65ad338030321576dc13a343"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://osv.dev/vulnerability/EEF-CVE-2026-59248"
          }
        ],
        "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-770"
              }
            ],
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-21T00:13:06+00:00",
      "cve": "CVE-2026-59248",
      "id": "CVE-2026-59248",
      "initial_release_date": "2026-07-28T09:54:19.579000+00:00",
      "product_status:fixed": "6",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "cowlib: Cowlib: Denial of Service due to unbounded HPACK/QPACK prefixed-integer decoding",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59248.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-59248",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-28T12:39:48.662716Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-28T12:40:49.783Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://repo.hex.pm",
              "cpes": [
                "cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "modules": [
                "cow_hpack",
                "cow_qpack"
              ],
              "packageName": "cowlib",
              "packageURL": "pkg:hex/cowlib",
              "product": "cowlib",
              "programFiles": [
                "src/cow_hpack_common.hrl",
                "src/cow_hpack.erl",
                "src/cow_qpack.erl"
              ],
              "programRoutines": [
                {
                  "name": "cow_hpack:decode/2"
                },
                {
                  "name": "cow_qpack:decode_field_section/3"
                }
              ],
              "repo": "https://github.com/ninenines/cowlib",
              "vendor": "ninenines",
              "versions": [
                {
                  "lessThan": "2.19.0",
                  "status": "affected",
                  "version": "2.0.0-pre.1",
                  "versionType": "semver"
                }
              ]
            },
            {
              "collectionURL": "https://github.com",
              "cpes": [
                "cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "modules": [
                "cow_hpack",
                "cow_qpack"
              ],
              "packageName": "ninenines/cowlib",
              "packageURL": "pkg:github/ninenines/cowlib",
              "product": "cowlib",
              "programFiles": [
                "src/cow_hpack_common.hrl",
                "src/cow_hpack.erl",
                "src/cow_qpack.erl"
              ],
              "programRoutines": [
                {
                  "name": "cow_hpack:decode/2"
                },
                {
                  "name": "cow_qpack:decode_field_section/3"
                }
              ],
              "repo": "https://github.com/ninenines/cowlib",
              "vendor": "ninenines",
              "versions": [
                {
                  "lessThan": "f582430498072a0c65ad338030321576dc13a343",
                  "status": "affected",
                  "version": "5ddecbc121f812aec53d9df91829448d8e94e44c",
                  "versionType": "git"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "2.19.0",
                      "versionStartIncluding": "2.0.0-pre.1",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ],
              "operator": "AND"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "David Hern\u00e1ndez"
            },
            {
              "lang": "en",
              "type": "reporter",
              "value": "Jonatan M\u00e4nnchen / EEF"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "Lo\u00efc Hoguin"
            },
            {
              "lang": "en",
              "type": "analyst",
              "value": "Jonatan M\u00e4nnchen / EEF"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eAllocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of service.\u003c/p\u003e\u003cp\u003eThe HPACK and QPACK prefixed-integer decoder \u003ctt\u003ecow_hpack_common:dec_big_int/3\u003c/tt\u003e in \u003ctt\u003esrc/cow_hpack_common.hrl\u003c/tt\u003e (invoked from \u003ctt\u003ecow_hpack:decode/2\u003c/tt\u003e in \u003ctt\u003esrc/cow_hpack.erl\u003c/tt\u003e and from \u003ctt\u003ecow_qpack:decode_field_section/3\u003c/tt\u003e in \u003ctt\u003esrc/cow_qpack.erl\u003c/tt\u003e) reads continuation octets until it sees one whose high bit is clear, evaluating \u003ctt\u003eInt + (Value bsl M)\u003c/tt\u003e at each step with the shift \u003ctt\u003eM\u003c/tt\u003e growing by seven per octet. No limit is enforced on the number of continuation octets, on the resulting bit width, or on the value; the decoder consumes whatever encoded length the peer supplies.\u003c/p\u003e\u003cp\u003eBecause Erlang integers are immutable, each intermediate \u003ctt\u003eValue bsl M\u003c/tt\u003e and each accumulator update allocates a fresh bignum whose digit width grows linearly with the number of octets processed so far. Summed across the whole decode, the transient bignum digit materialization is on the order of the square of the encoded length. A single maximal HPACK indexed representation carried inside one HTTP/2 \u003ctt\u003eHEADERS\u003c/tt\u003e plus one \u003ctt\u003eCONTINUATION\u003c/tt\u003e frame at Cowboy\u0027s default \u003ctt\u003emax_frame_size_received\u003c/tt\u003e can force hundreds of megabytes of transient allocation and garbage-collection churn before the resulting header-table index is rejected as invalid. Repeated or concurrent connections multiply the pressure and can drive the Erlang VM to memory exhaustion.\u003c/p\u003e\u003cp\u003eCowlib is the HTTP parser used by Cowboy, RabbitMQ\u0027s management plugin, and other Erlang and Elixir HTTP/2 and HTTP/3 servers and clients, so any exposed endpoint that accepts HPACK or QPACK from an untrusted peer is reachable.\u003c/p\u003e\u003cp\u003eThis issue affects cowlib: from 2.0.0 before 2.19.0.\u003c/p\u003e"
                }
              ],
              "value": "Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of service.\n\nThe HPACK and QPACK prefixed-integer decoder cow_hpack_common:dec_big_int/3 in src/cow_hpack_common.hrl (invoked from cow_hpack:decode/2 in src/cow_hpack.erl and from cow_qpack:decode_field_section/3 in src/cow_qpack.erl) reads continuation octets until it sees one whose high bit is clear, evaluating Int + (Value bsl M) at each step with the shift M growing by seven per octet. No limit is enforced on the number of continuation octets, on the resulting bit width, or on the value; the decoder consumes whatever encoded length the peer supplies.\n\nBecause Erlang integers are immutable, each intermediate Value bsl M and each accumulator update allocates a fresh bignum whose digit width grows linearly with the number of octets processed so far. Summed across the whole decode, the transient bignum digit materialization is on the order of the square of the encoded length. A single maximal HPACK indexed representation carried inside one HTTP/2 HEADERS plus one CONTINUATION frame at Cowboy\u0027s default max_frame_size_received can force hundreds of megabytes of transient allocation and garbage-collection churn before the resulting header-table index is rejected as invalid. Repeated or concurrent connections multiply the pressure and can drive the Erlang VM to memory exhaustion.\n\nCowlib is the HTTP parser used by Cowboy, RabbitMQ\u0027s management plugin, and other Erlang and Elixir HTTP/2 and HTTP/3 servers and clients, so any exposed endpoint that accepts HPACK or QPACK from an untrusted peer is reachable.\n\nThis issue affects cowlib: from 2.0.0 before 2.19.0."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-130",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-130 Excessive Allocation"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-770",
                  "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-29T04:18:17.483Z",
            "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "shortName": "EEF"
          },
          "references": [
            {
              "tags": [
                "third-party-advisory",
                "related"
              ],
              "url": "https://cna.erlef.org/cves/CVE-2026-59248.html"
            },
            {
              "tags": [
                "related"
              ],
              "url": "https://osv.dev/vulnerability/EEF-CVE-2026-59248"
            },
            {
              "tags": [
                "patch"
              ],
              "url": "https://github.com/ninenines/cowlib/commit/f582430498072a0c65ad338030321576dc13a343"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "assignerShortName": "EEF",
        "cveId": "CVE-2026-59248",
        "datePublished": "2026-07-28T09:54:19.579Z",
        "dateReserved": "2026-07-04T04:24:03.652Z",
        "dateUpdated": "2026-07-29T04:18:17.483Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-59248

Vulnerability from fkie_nvd - Published: 2026-07-28 10:16 - Updated: 2026-10-24 13:10

Severity

8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://cna.erlef.org/cves/CVE-2026-59248.html
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/ninenines/cowlib/commit/f582430498072a0c65ad338030321576dc13a343
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://osv.dev/vulnerability/EEF-CVE-2026-59248

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "cow_hpack",
            "cow_qpack"
          ],
          "packageName": "cowlib",
          "packageURL": "pkg:hex/cowlib",
          "product": "cowlib",
          "programFiles": [
            "src/cow_hpack_common.hrl",
            "src/cow_hpack.erl",
            "src/cow_qpack.erl"
          ],
          "programRoutines": [
            {
              "name": "cow_hpack:decode/2"
            },
            {
              "name": "cow_qpack:decode_field_section/3"
            }
          ],
          "repo": "https://github.com/ninenines/cowlib",
          "vendor": "ninenines",
          "versions": [
            {
              "lessThan": "2.19.0",
              "status": "affected",
              "version": "2.0.0-pre.1",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "cow_hpack",
            "cow_qpack"
          ],
          "packageName": "ninenines/cowlib",
          "packageURL": "pkg:github/ninenines/cowlib",
          "product": "cowlib",
          "programFiles": [
            "src/cow_hpack_common.hrl",
            "src/cow_hpack.erl",
            "src/cow_qpack.erl"
          ],
          "programRoutines": [
            {
              "name": "cow_hpack:decode/2"
            },
            {
              "name": "cow_qpack:decode_field_section/3"
            }
          ],
          "repo": "https://github.com/ninenines/cowlib",
          "vendor": "ninenines",
          "versions": [
            {
              "lessThan": "f582430498072a0c65ad338030321576dc13a343",
              "status": "affected",
              "version": "5ddecbc121f812aec53d9df91829448d8e94e44c",
              "versionType": "git"
            }
          ]
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of service.\n\nThe HPACK and QPACK prefixed-integer decoder cow_hpack_common:dec_big_int/3 in src/cow_hpack_common.hrl (invoked from cow_hpack:decode/2 in src/cow_hpack.erl and from cow_qpack:decode_field_section/3 in src/cow_qpack.erl) reads continuation octets until it sees one whose high bit is clear, evaluating Int + (Value bsl M) at each step with the shift M growing by seven per octet. No limit is enforced on the number of continuation octets, on the resulting bit width, or on the value; the decoder consumes whatever encoded length the peer supplies.\n\nBecause Erlang integers are immutable, each intermediate Value bsl M and each accumulator update allocates a fresh bignum whose digit width grows linearly with the number of octets processed so far. Summed across the whole decode, the transient bignum digit materialization is on the order of the square of the encoded length. A single maximal HPACK indexed representation carried inside one HTTP/2 HEADERS plus one CONTINUATION frame at Cowboy\u0027s default max_frame_size_received can force hundreds of megabytes of transient allocation and garbage-collection churn before the resulting header-table index is rejected as invalid. Repeated or concurrent connections multiply the pressure and can drive the Erlang VM to memory exhaustion.\n\nCowlib is the HTTP parser used by Cowboy, RabbitMQ\u0027s management plugin, and other Erlang and Elixir HTTP/2 and HTTP/3 servers and clients, so any exposed endpoint that accepts HPACK or QPACK from an untrusted peer is reachable.\n\nThis issue affects cowlib: from 2.0.0 before 2.19.0."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de asignaci\u00f3n de recursos sin l\u00edmites en ninenines cowlib permite que un par HTTP/2 o HTTP/3 remoto no autenticado agote la memoria en el servidor (o cliente) vulnerable y cause una denegaci\u00f3n de servicio.\n\nEl decodificador de enteros con prefijo HPACK y QPACK cow_hpack_common:dec_big_int/3 en src/cow_hpack_common.hrl (invocado desde cow_hpack:decode/2 en src/cow_hpack.erl y desde cow_qpack:decode_field_section/3 en src/cow_qpack.erl) lee octetos de continuaci\u00f3n hasta que ve uno cuyo bit m\u00e1s significativo est\u00e1 claro, evaluando Int + (Value bsl M) en cada paso con el desplazamiento M creciendo en siete por octeto. No se impone ning\u00fan l\u00edmite en el n\u00famero de octetos de continuaci\u00f3n, en el ancho de bits resultante o en el valor; el decodificador consume cualquier longitud codificada que el par suministre.\n\nDebido a que los enteros de Erlang son inmutables, cada Value bsl M intermedio y cada actualizaci\u00f3n del acumulador asigna un nuevo bignum cuyo ancho de d\u00edgito crece linealmente con el n\u00famero de octetos procesados hasta ahora. Sumado a lo largo de toda la decodificaci\u00f3n, la materializaci\u00f3n transitoria de d\u00edgitos bignum es del orden del cuadrado de la longitud codificada. Una \u00fanica representaci\u00f3n indexada HPACK m\u00e1xima transportada dentro de un frame HTTP/2 HEADERS m\u00e1s un frame CONTINUATION en el max_frame_size_received predeterminado de Cowboy puede forzar cientos de megabytes de asignaci\u00f3n transitoria y agitaci\u00f3n de recolecci\u00f3n de basura antes de que el \u00edndice de la tabla de encabezados resultante sea rechazado como inv\u00e1lido. Las conexiones repetidas o concurrentes multiplican la presi\u00f3n y pueden llevar a la VM de Erlang al agotamiento de la memoria.\n\nCowlib es el analizador HTTP utilizado por Cowboy, el plugin de gesti\u00f3n de RabbitMQ, y otros servidores y clientes HTTP/2 y HTTP/3 de Erlang y Elixir, por lo que cualquier punto final expuesto que acepte HPACK o QPACK de un par no confiable es alcanzable.\n\nEste problema afecta a cowlib: desde 2.0.0 antes de 2.19.0."
    }
  ],
  "id": "CVE-2026-59248",
  "lastModified": "2026-10-24T13:10:00.147",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-59248",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-28T12:39:48.662716Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-28T10:16:50.083",
  "references": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://cna.erlef.org/cves/CVE-2026-59248.html"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/ninenines/cowlib/commit/f582430498072a0c65ad338030321576dc13a343"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-59248"
    }
  ],
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary"
    }
  ]
}

GHSA-F37P-PC7R-RGHM

Vulnerability from github – Published: 2026-07-28 12:31 – Updated: 2026-07-28 12:31

Details

The HPACK and QPACK prefixed-integer decoder cow_hpack_common:dec_big_int/3 in src/cow_hpack_common.hrl (invoked from cow_hpack:decode/2 in src/cow_hpack.erl and from cow_qpack:decode_field_section/3 in src/cow_qpack.erl) reads continuation octets until it sees one whose high bit is clear, evaluating Int + (Value bsl M) at each step with the shift M growing by seven per octet. No limit is enforced on the number of continuation octets, on the resulting bit width, or on the value; the decoder consumes whatever encoded length the peer supplies.

Because Erlang integers are immutable, each intermediate Value bsl M and each accumulator update allocates a fresh bignum whose digit width grows linearly with the number of octets processed so far. Summed across the whole decode, the transient bignum digit materialization is on the order of the square of the encoded length. A single maximal HPACK indexed representation carried inside one HTTP/2 HEADERS plus one CONTINUATION frame at Cowboy's default max_frame_size_received can force hundreds of megabytes of transient allocation and garbage-collection churn before the resulting header-table index is rejected as invalid. Repeated or concurrent connections multiply the pressure and can drive the Erlang VM to memory exhaustion.

Cowlib is the HTTP parser used by Cowboy, RabbitMQ's management plugin, and other Erlang and Elixir HTTP/2 and HTTP/3 servers and clients, so any exposed endpoint that accepts HPACK or QPACK from an untrusted peer is reachable.

This issue affects cowlib: from 2.0.0 before 2.19.0.

Severity

8.7 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-59248"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-770"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-28T10:16:50Z",
    "severity": "HIGH"
  },
  "details": "Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of service.\n\nThe HPACK and QPACK prefixed-integer decoder cow_hpack_common:dec_big_int/3 in src/cow_hpack_common.hrl (invoked from cow_hpack:decode/2 in src/cow_hpack.erl and from cow_qpack:decode_field_section/3 in src/cow_qpack.erl) reads continuation octets until it sees one whose high bit is clear, evaluating Int + (Value bsl M) at each step with the shift M growing by seven per octet. No limit is enforced on the number of continuation octets, on the resulting bit width, or on the value; the decoder consumes whatever encoded length the peer supplies.\n\nBecause Erlang integers are immutable, each intermediate Value bsl M and each accumulator update allocates a fresh bignum whose digit width grows linearly with the number of octets processed so far. Summed across the whole decode, the transient bignum digit materialization is on the order of the square of the encoded length. A single maximal HPACK indexed representation carried inside one HTTP/2 HEADERS plus one CONTINUATION frame at Cowboy\u0027s default max_frame_size_received can force hundreds of megabytes of transient allocation and garbage-collection churn before the resulting header-table index is rejected as invalid. Repeated or concurrent connections multiply the pressure and can drive the Erlang VM to memory exhaustion.\n\nCowlib is the HTTP parser used by Cowboy, RabbitMQ\u0027s management plugin, and other Erlang and Elixir HTTP/2 and HTTP/3 servers and clients, so any exposed endpoint that accepts HPACK or QPACK from an untrusted peer is reachable.\n\nThis issue affects cowlib: from 2.0.0 before 2.19.0.",
  "id": "GHSA-f37p-pc7r-rghm",
  "modified": "2026-07-28T12:31:20Z",
  "published": "2026-07-28T12:31:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59248"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ninenines/cowlib/commit/f582430498072a0c65ad338030321576dc13a343"
    },
    {
      "type": "WEB",
      "url": "https://cna.erlef.org/cves/CVE-2026-59248.html"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-59248"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

MSRC_CVE-2026-59248

Vulnerability from csaf_microsoft - Published: 2026-08-07 00:56 - Updated: 2026-09-13 01:45

Summary

Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS

Scope

1 vulnerability in this advisory, including CVE-2026-59248.

CVE-2026-59248

Fixed: 1 product Known affected: 2 products

Open the full advisory

RHSA-2026:47231

Vulnerability from csaf_redhat - Published: 2026-07-28 19:26 - Updated: 2026-09-07 23:11

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Severity

Important

Scope

2 vulnerabilities in this advisory, including CVE-2026-59248.

CVE-2026-59248

A flaw was found in cowlib, an HTTP parser. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 frames containing oversized HPACK or QPACK prefixed integers. This unbounded decoding process leads to excessive memory allocation and garbage collection, ultimately causing memory exhaustion and a denial of service (DoS) on the vulnerable server or client.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 3 products

https://access.redhat.com/errata/RHSA-2026:47231

Open the full advisory

RHSA-2026:47236

Vulnerability from csaf_redhat - Published: 2026-07-28 19:59 - Updated: 2026-09-07 02:36

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Severity

Important

Scope

2 vulnerabilities in this advisory, including CVE-2026-59248.

CVE-2026-59248

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 3 products

https://access.redhat.com/errata/RHSA-2026:47236

Open the full advisory

RHSA-2026:57882

Vulnerability from csaf_redhat - Published: 2026-08-21 00:09 - Updated: 2026-09-07 22:44

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Severity

Important

Scope

2 vulnerabilities in this advisory, including CVE-2026-59248.

CVE-2026-59248

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 3 products

https://access.redhat.com/errata/RHSA-2026:57882

Open the full advisory

UBUNTU-CVE-2026-59248 (CVE-2026-59248)

Vulnerability from osv_ubuntu – Published: 2026-07-28 10:16 – Updated: 2026-10-17 09:45 – Source website

Details

Severity

8.7 (High)


                    
                      CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-59248	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-59248	REPORT
	https://cna.erlef.org/cves/CVE-2026-59248.html	REPORT
	https://ubuntu.com/security/notices/USN-8869-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "rabbitmq-server",
            "binary_version": "3.5.7-1ubuntu0.16.04.4+esm3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "rabbitmq-server",
        "purl": "pkg:deb/ubuntu/rabbitmq-server@3.5.7-1ubuntu0.16.04.4+esm3?arch=source\u0026distro=esm-infra-legacy/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.5.4-1",
        "3.5.4-3",
        "3.5.4-3.1",
        "3.5.7-1",
        "3.5.7-1ubuntu0.16.04.1",
        "3.5.7-1ubuntu0.16.04.2",
        "3.5.7-1ubuntu0.16.04.4",
        "3.5.7-1ubuntu0.16.04.4+esm1",
        "3.5.7-1ubuntu0.16.04.4+esm2",
        "3.5.7-1ubuntu0.16.04.4+esm3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "erlang-cowlib",
            "binary_version": "1.3.0-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "erlang-cowlib",
        "purl": "pkg:deb/ubuntu/erlang-cowlib@1.3.0-1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.3.0-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "rabbitmq-server",
            "binary_version": "3.6.10-1ubuntu0.5+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "rabbitmq-server",
        "purl": "pkg:deb/ubuntu/rabbitmq-server@3.6.10-1ubuntu0.5+esm1?arch=source\u0026distro=esm-infra/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.6.10-1",
        "3.6.10-1ubuntu0.1",
        "3.6.10-1ubuntu0.3",
        "3.6.10-1ubuntu0.4",
        "3.6.10-1ubuntu0.5",
        "3.6.10-1ubuntu0.5+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "erlang-cowlib",
            "binary_version": "1.3.0-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "erlang-cowlib",
        "purl": "pkg:deb/ubuntu/erlang-cowlib@1.3.0-2?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.3.0-2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "rabbitmq-server",
            "binary_version": "3.8.3-0ubuntu0.3+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "rabbitmq-server",
        "purl": "pkg:deb/ubuntu/rabbitmq-server@3.8.3-0ubuntu0.3+esm1?arch=source\u0026distro=esm-infra/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.8.3-0ubuntu0.3+esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.7.8-4ubuntu2",
        "3.7.18-1",
        "3.8.2-0ubuntu1",
        "3.8.2-0ubuntu1.1",
        "3.8.2-0ubuntu1.2",
        "3.8.2-0ubuntu1.3",
        "3.8.2-0ubuntu1.4",
        "3.8.2-0ubuntu1.5",
        "3.8.3-0ubuntu0.1",
        "3.8.3-0ubuntu0.2",
        "3.8.3-0ubuntu0.3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "erlang-cowlib",
            "binary_version": "1.3.0-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "erlang-cowlib",
        "purl": "pkg:deb/ubuntu/erlang-cowlib@1.3.0-3?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.3.0-3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "erlang-cowlib",
            "binary_version": "1.3.0-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "erlang-cowlib",
        "purl": "pkg:deb/ubuntu/erlang-cowlib@1.3.0-3?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.3.0-3"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "rabbitmq-server",
            "binary_version": "3.9.27-0ubuntu0.5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "rabbitmq-server",
        "purl": "pkg:deb/ubuntu/rabbitmq-server@3.9.27-0ubuntu0.5?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.27-0ubuntu0.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.8.9-3ubuntu1",
        "3.9.8-1",
        "3.9.8-2",
        "3.9.8-3",
        "3.9.8-5",
        "3.9.8-6",
        "3.9.13-1",
        "3.9.13-1ubuntu0.22.04.1",
        "3.9.13-1ubuntu0.22.04.2",
        "3.9.27-0ubuntu0.1",
        "3.9.27-0ubuntu0.2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "erlang-cowlib",
            "binary_version": "1.3.0-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "erlang-cowlib",
        "purl": "pkg:deb/ubuntu/erlang-cowlib@1.3.0-3?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.3.0-3"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "rabbitmq-server",
            "binary_version": "3.12.1-1ubuntu1.6"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "rabbitmq-server",
        "purl": "pkg:deb/ubuntu/rabbitmq-server@3.12.1-1ubuntu1.6?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.12.1-1ubuntu1.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.12.1-1",
        "3.12.1-1ubuntu1",
        "3.12.1-1ubuntu1.2",
        "3.12.1-1ubuntu1.4"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "erlang-cowlib",
            "binary_version": "2.19.0-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.10",
        "name": "erlang-cowlib",
        "purl": "pkg:deb/ubuntu/erlang-cowlib@2.19.0-1?arch=source\u0026distro=stonking"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.3.0-3build1",
        "2.19.0-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "rabbitmq-server",
            "binary_version": "4.3.2-4ubuntu3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.10",
        "name": "rabbitmq-server",
        "purl": "pkg:deb/ubuntu/rabbitmq-server@4.3.2-4ubuntu3?arch=source\u0026distro=stonking"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.0.5-10ubuntu5",
        "4.3.2-4ubuntu2",
        "4.3.2-4ubuntu3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "erlang-cowlib",
            "binary_version": "1.3.0-3build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "erlang-cowlib",
        "purl": "pkg:deb/ubuntu/erlang-cowlib@1.3.0-3build1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.3.0-3",
        "1.3.0-3build1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "rabbitmq-server",
            "binary_version": "4.0.5-10ubuntu5.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "rabbitmq-server",
        "purl": "pkg:deb/ubuntu/rabbitmq-server@4.0.5-10ubuntu5.1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.0.5-10ubuntu5.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.0.5-8ubuntu2",
        "4.0.5-10ubuntu1",
        "4.0.5-10ubuntu2",
        "4.0.5-10ubuntu3",
        "4.0.5-10ubuntu4",
        "4.0.5-10ubuntu5"
      ]
    }
  ],
  "aliases": [],
  "details": "Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of service. The HPACK and QPACK prefixed-integer decoder cow_hpack_common:dec_big_int/3 in src/cow_hpack_common.hrl (invoked from cow_hpack:decode/2 in src/cow_hpack.erl and from cow_qpack:decode_field_section/3 in src/cow_qpack.erl) reads continuation octets until it sees one whose high bit is clear, evaluating Int + (Value bsl M) at each step with the shift M growing by seven per octet. No limit is enforced on the number of continuation octets, on the resulting bit width, or on the value; the decoder consumes whatever encoded length the peer supplies. Because Erlang integers are immutable, each intermediate Value bsl M and each accumulator update allocates a fresh bignum whose digit width grows linearly with the number of octets processed so far. Summed across the whole decode, the transient bignum digit materialization is on the order of the square of the encoded length. A single maximal HPACK indexed representation carried inside one HTTP/2 HEADERS plus one CONTINUATION frame at Cowboy\u0027s default max_frame_size_received can force hundreds of megabytes of transient allocation and garbage-collection churn before the resulting header-table index is rejected as invalid. Repeated or concurrent connections multiply the pressure and can drive the Erlang VM to memory exhaustion. Cowlib is the HTTP parser used by Cowboy, RabbitMQ\u0027s management plugin, and other Erlang and Elixir HTTP/2 and HTTP/3 servers and clients, so any exposed endpoint that accepts HPACK or QPACK from an untrusted peer is reachable. This issue affects cowlib: from 2.0.0 before 2.19.0.",
  "id": "UBUNTU-CVE-2026-59248",
  "modified": "2026-10-17T09:45:59Z",
  "published": "2026-07-28T10:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-59248"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59248"
    },
    {
      "type": "REPORT",
      "url": "https://cna.erlef.org/cves/CVE-2026-59248.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8869-1"
    }
  ],
  "related": [
    "USN-8869-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-59248"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-59248 (GCVE-0-2026-59248)

FKIE_CVE-2026-59248

GHSA-F37P-PC7R-RGHM

MSRC_CVE-2026-59248

RHSA-2026:47231

RHSA-2026:47236

RHSA-2026:57882

UBUNTU-CVE-2026-59248 (CVE-2026-59248)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour