Read the docs
TI-2026-85816 Aliases CVE-2026-113431GHSA-9jxc-cwfw-gpg8

Unbounded HTTP/2 header list size in cowlib enables memory exhaustion

Priority LOW 38CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-770.

Summary

Cowlib from 2.7.0 onward does not limit the size of decoded HTTP/2 header lists. The function cow_http2_machine:headers_decode/4 decodes HPACK-compressed header blocks without enforcing SETTINGS_MAX_HEADER_LIST_SIZE (CWE-770). An unauthenticated remote peer can send about 100 bytes of HPACK-indexed header fields that decode to a header list of about 390 KB, and a consumer that copies those values allocates that memory for every stream, which can exhaust the memory of the HTTP/2 endpoint.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowlib allows an unauthenticated remote peer to exhaust the memory of an HTTP/2 endpoint via HPACK-indexed header fields. cow_http2_machine:headers_decode/4 in src/cow_http2_machine.erl decodes every HEADERS block with cow_hpack:decode/3. It bounds the compressed block size and the number of fields, but not the size of the decoded header list that RFC 9113 section 6.5.2 places under SETTINGS_MAX_HEADER_LIST_SIZE. A peer stores one header value of up to the dynamic table size (4096 bytes by default) and then references it with one-byte indexed fields, so about 100 bytes on the wire decode to a header list of about 390 KB. A consumer that copies the decoded values, as Cowboy does when cowboy_http2:headers_to_map/2 joins repeated cookie fields into one binary, allocates that amount for every stream. The total across streams and connections is not bounded. This issue affects cowlib: from 2.7.0 onward.

Why it matters now

EPSS 0.00419 36th percentileScored 2026-11-07
Fix Fixed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
nineninescowlib2.7.0 and later—No fix listedCNA
  • cowlib Vendorninenines Affected 2.7.0 and later Fixed in — No fix listed CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*——ninenines
  • cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:* Versions — — ·ninenines

Remediation

The sources list no fixed version for cowlib.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-113431
  2. 2026-11-06 Alias added: GHSA-9jxc-cwfw-gpg8
  3. 2026-11-08 Priority changed: MEDIUM → LOW

References

Patch 1

Advisory 1

Other 2

  • TI-2026-32019 gun HTTP/1.1 client accepts unsolicited 101 Switching Protocols response allowing server-driven protocol hijack and OOM CVSS 4.0HIGH 8.7
  • TI-2026-32018 gun HTTP/1.1 response buffer has no size limit allowing server-controlled memory exhaustion CVSS 4.0HIGH 8.7
  • TI-2026-06860 Unbounded chunk-size hex digits in cowlib cause quadratic CPU and memory DoS CVSS 4.0HIGH 8.7
  • TI-2026-42388 Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS CVSS 4.0HIGH 8.7
  • TI-2026-46781 Cowboy HTTP/1.1 max_headers Bypass via Duplicate Header Names Enables Memory Exhaustion CVSS 4.0MEDIUM 6.9
  • TI-2026-85817 Unbounded buffering of pipelined data in Cowboy exhausts memory CVSS 4.0HIGH 8.2
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences