PT-2026-65435 · Cowlib · Cowlib
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
cowlib versions 2.0.0 through 2.18.x
Description
An unauthenticated remote HTTP/2 or HTTP/3 peer can cause a denial of service by exhausting memory on a server or client. The issue exists in the HPACK and QPACK prefixed-integer decoder
cow hpack common:dec big int/3 (invoked from cow hpack:decode/2 and cow qpack:decode field section/3), which fails to enforce limits on the number of continuation octets, the resulting bit width, or the final value. Because Erlang integers are immutable, each update allocates a new bignum, leading to transient memory allocation that grows quadratically relative to the encoded length. A single maximal HPACK indexed representation within HTTP/2 HEADERS and CONTINUATION frames can trigger hundreds of megabytes of allocation and garbage-collection churn, potentially leading to Erlang VM memory exhaustion when repeated or concurrent connections are used.Recommendations
Update cowlib to version 2.19.0 or later.
Fix
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cowlib