PT-2026-40777 · Cowlib · Cowlib

Loïc Hoguin + 1 · Published 2026-05-13 · Updated 2026-05-13 · CVE-2026-43970

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions cowlib versions 0.1.0 through 2.16.0

Description Improper handling of highly compressed data leads to data amplification, allowing an unauthenticated remote actor to cause a denial of service via memory exhaustion. The cow spdy:inflate/2 function passes compressed bytes from a peer to zlib:inflate/2 without an output size bound. Because the SPDY header compression dictionary (?ZDICT) is public and zlib can compress repeated bytes at a ratio of approximately 1024:1, a small SPDY frame payload can decompress into gigabytes on the BEAM heap, resulting in an Out-Of-Memory (OOM) condition that kills the node. This condition can be triggered by a single unauthenticated SPDY frame. The cow spdy:parse headers/2 function affects the parsers for syn stream, syn reply, and headers frame types. This issue specifically impacts applications that use cow spdy:parse/2 to parse SPDY frames from untrusted peers.

Recommendations Update to version 2.16.1 or later. As a temporary mitigation, restrict the use of the cow spdy:parse/2 function when handling data from untrusted peers.

Fix

DoS

Weakness Enumeration

CWE-409

Related Identifiers

CVE-2026-43970

GHSA-84F2-RP86-235P

Affected Products

Cowlib

References · 13

• https://github.com/ninenines/cowlib/commit/16aad3fb9f81f5cda4d1706ff0c54237c619c282 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43970 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43970 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-43970 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-43970 · Security Note
• https://osv.dev/vulnerability/EEF-CVE-2026-43970 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-84f2-rp86-235p · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-43970 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-43970 · Vendor Advisory
• https://github.com/ninenines/cowlib · Note
• https://cna.erlef.org/cves/CVE-2026-43970.html · Note
• https://twitter.com/CVEnew/status/2054709268956471791 · Twitter Post
• https://hex.pm/packages/cowlib · Note