David Hernández

**Name of the Vulnerable Software and Affected Versions** cowlib versions 2.0.0 through 2.18.x **Description** An unauthenticated remote HTTP/2 or HTTP/3 peer can cause a denial of service by exhausting memory on a server or client. The issue exists in the HPACK and QPACK prefixed-integer decoder `cow hpack common:dec big int/3` (invoked from `cow hpack:decode/2` and `cow qpack:decode field section/3`), which fails to enforce limits on the number of continuation octets, the resulting bit width, or the final value. Because Erlang integers are immutable, each update allocates a new bignum, leading to transient memory allocation that grows quadratically relative to the encoded length. A single maximal HPACK indexed representation within HTTP/2 HEADERS and CONTINUATION frames can trigger hundreds of megabytes of allocation and garbage-collection churn, potentially leading to Erlang VM memory exhaustion when repeated or concurrent connections are used. **Recommendations** Update cowlib to version 2.19.0 or later.