CVE-2026-59248
Received Received - Intake

Allocation of Resources Without Limits in cowlib

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: EEF

Description
Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of service. The HPACK and QPACK prefixed-integer decoder cow_hpack_common:dec_big_int/3 in src/cow_hpack_common.hrl (invoked from cow_hpack:decode/2 in src/cow_hpack.erl and from cow_qpack:decode_field_section/3 in src/cow_qpack.erl) reads continuation octets until it sees one whose high bit is clear, evaluating Int + (Value bsl M) at each step with the shift M growing by seven per octet. No limit is enforced on the number of continuation octets, on the resulting bit width, or on the value; the decoder consumes whatever encoded length the peer supplies. Because Erlang integers are immutable, each intermediate Value bsl M and each accumulator update allocates a fresh bignum whose digit width grows linearly with the number of octets processed so far. Summed across the whole decode, the transient bignum digit materialization is on the order of the square of the encoded length. A single maximal HPACK indexed representation carried inside one HTTP/2 HEADERS plus one CONTINUATION frame at Cowboy's default max_frame_size_received can force hundreds of megabytes of transient allocation and garbage-collection churn before the resulting header-table index is rejected as invalid. Repeated or concurrent connections multiply the pressure and can drive the Erlang VM to memory exhaustion. Cowlib is the HTTP parser used by Cowboy, RabbitMQ's management plugin, and other Erlang and Elixir HTTP/2 and HTTP/3 servers and clients, so any exposed endpoint that accepts HPACK or QPACK from an untrusted peer is reachable. This issue affects cowlib: from 2.0.0 before 2.19.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-59248
EUVD
EUVD-2026-49739

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ninenines cowlib From 2.0.0 (inc) to 2.19.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an allocation of resources without limits issue in the ninenines cowlib library. It allows an unauthenticated remote peer using HTTP/2 or HTTP/3 to exhaust memory on a vulnerable server or client by sending specially crafted frames. The problem occurs in the HPACK and QPACK prefixed-integer decoder, which does not enforce limits on the number of continuation octets or the resulting bit width. Each decoding step allocates new bignum objects, causing memory usage to grow quadratically with the input size. A single malicious frame can force hundreds of megabytes of memory usage, potentially leading to a denial of service.

Detection Guidance

To detect this vulnerability, monitor for unusual memory usage spikes in Erlang VM processes running cowlib-based applications. Check for HTTP/2 or HTTP/3 connections with abnormally large header sizes or continuation frames. Use Erlang VM tools like `erlang:memory()` or `observer:start()` to inspect memory allocation patterns.

Impact Analysis

If you use software that relies on cowlib versions 2.0.0 to 2.18.0, such as Cowboy or RabbitMQ's management plugin, an attacker could send malicious HTTP/2 or HTTP/3 frames to exhaust server memory. This could cause the server to slow down, crash, or become unresponsive, disrupting services. The impact is worse if multiple attacks occur simultaneously, as they can quickly consume all available memory on the system.

Mitigation Strategies

Immediately upgrade cowlib to version 2.19.0 or later. If upgrading is not possible, restrict network access to HTTP/2 and HTTP/3 endpoints using firewalls or reverse proxies. Monitor for suspicious traffic patterns and implement rate limiting to prevent abuse.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59248. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart