Read the docs
TI-2026-06860 Aliases CVE-2026-7790GHSA-32p9-57cr-4x65

Unbounded chunk-size hex digits in cowlib cause quadratic CPU and memory DoS

Priority MEDIUM 44CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

Uncontrolled Resource Consumption vulnerability in ninenines cowlib (cow_http_te module) allows Excessive Allocation. The chunked transfer-encoding parser in cow_http_te accepts an unbounded number of hex digits in the chunk-size field. Each digit causes a bignum multiplication (Len * 16 + digit), so parsing N hex digits requires O(N²) CPU work and O(N) memory. Additionally, when input is drip-fed, the parser discards the accumulated length on each partial read and restarts from zero on resumption, raising the cost to O(N³). An unauthenticated remote attacker can exploit this by sending an HTTP/1.1 request with Transfer-Encoding: chunked and a very long chunk-size hex string to cause denial of service through CPU exhaustion and memory amplification. This vulnerability is associated with program file src/cow_http_te.erl and program routines cow_http_te:stream_chunked/2, cow_http_te:chunked_len/4. This issue affects cowlib: from 0.6.0 before 2.16.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00431 37th percentileScored 2026-11-07
Fix Fixed cowlib (ninenines): 2.16.1cowlib (Hex): 2.16.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nineninescowlib0.6.0 to before 2.16.12.16.1Patch availableCNA
—cowlib (Hex)0.6.0 to before 2.16.12.16.1Patch availableGHSA-32p9-57cr-4x65
  • cowlib Vendorninenines Affected 0.6.0 to before 2.16.1 Fixed in 2.16.1 Patch available CNA
  • cowlib (Hex) Vendor— Affected 0.6.0 to before 2.16.1 Fixed in 2.16.1 Patch available GHSA-32p9-57cr-4x65

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*0.6.0 to before 2.16.1Vulnerableninenines
  • cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:* Versions 0.6.0 to before 2.16.1 Vulnerable ·ninenines

Remediation

  • Fix · CNA cowlib (ninenines) Fixed in 2.16.1
  • Fix · GHSA-32p9-57cr-4x65 cowlib (Hex) Fixed in 2.16.1 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    ninenines cowlib 2.16.1

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-32013 CR Injection in SSE Encoder Enables Event Splitting via cow_sse:event/1Priority LOW 28
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-7790
  2. 2026-10-03 Alias added: GHSA-32p9-57cr-4x65
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Patch 1

Advisory 3

Other 2

  • TI-2026-32013 CR Injection in SSE Encoder Enables Event Splitting via cow_sse:event/1 CVSS 4.0MEDIUM 6.3
  • TI-2026-32011 HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2 CVSS 4.0MEDIUM 6.3
  • TI-2026-32014 Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1 CVSS 4.0LOW 2.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences