TI-2026-32015 Aliases CVE-2026-43970 GHSA-84f2-rp86-235p

Decompression Bomb in cow_spdy:inflate/2 Allows Memory Exhaustion via Crafted SPDY Frame

LOW 36CWE-409Published 2026-05-13 · Updated 2026-05-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: —
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenines cowlib allows unauthenticated remote denial of service via memory exhaustion. cow_spdy:inflate/2 in cowlib passes peer-supplied compressed bytes directly to zlib:inflate/2 with no output size bound. The SPDY header compression dictionary (?ZDICT) is public, and zlib compresses long runs of repeated bytes at roughly 1024:1, so a few kilobytes of SPDY frame payload can decompress to gigabytes on the BEAM heap, OOM-killing the node. A single unauthenticated SPDY frame is sufficient to trigger the condition. The parsers for syn_stream, syn_reply, and headers frame types are all affected via cow_spdy:parse_headers/2. This issue affects cowlib from 0.1.0 before 2.16.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00511 43rd percentileScored 2026-11-07

Fix Fixed cowlib (ninenines): 2.16.1cowlib (Hex): 2.16.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ninenines	cowlib	0.1.0 to before 2.16.1	2.16.1	Patch available	CNA
—	cowlib (Hex)	0.1.0 to before 2.16.1	2.16.1	Patch available	GHSA-84f2-rp86-235p

cowlib Vendorninenines Affected 0.1.0 to before 2.16.1 Fixed in 2.16.1 Patch available CNA
cowlib (Hex) Vendor— Affected 0.1.0 to before 2.16.1 Fixed in 2.16.1 Patch available GHSA-84f2-rp86-235p

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:ninenines:cowlib::::::::	—	—	ninenines

cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:* Versions — — ·ninenines

Remediation

Fix · CNA cowlib (ninenines) Fixed in 2.16.1
Fix · GHSA-84f2-rp86-235p cowlib (Hex) Fixed in 2.16.1 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2026-43970
2026-10-03 Alias added: GHSA-84f2-rp86-235p

References

Patch 1

https://github.com/ninenines/cowlib/commit/16aad3fb9f81f5cda4d1706ff0c54237c619c282

Advisory 2

Other 2

TI-2026-32019 gun HTTP/1.1 client accepts unsolicited 101 Switching Protocols response allowing server-driven protocol hijack and OOM CVSS 4.0HIGH 8.7
TI-2026-32018 gun HTTP/1.1 response buffer has no size limit allowing server-controlled memory exhaustion CVSS 4.0HIGH 8.7
TI-2026-06860 Unbounded chunk-size hex digits in cowlib cause quadratic CPU and memory DoS CVSS 4.0HIGH 8.7
TI-2026-42388 Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS CVSS 4.0HIGH 8.7
TI-2026-85816 Unbounded HTTP/2 header list size in cowlib enables memory exhaustion CVSS 4.0HIGH 8.7
TI-2026-46781 Cowboy HTTP/1.1 max_headers Bypass via Duplicate Header Names Enables Memory Exhaustion CVSS 4.0MEDIUM 6.9

See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences