Executive brief
A vulnerability in the cowlib Erlang library allows an attacker to crash a server by sending a specially crafted SPDY data frame. This library is used for manipulating web protocols, and the flaw can lead to a complete service outage by exhausting the server's memory. Organizations using this library in applications that process SPDY traffic are at risk of a remote denial-of-service attack.
Technical details
The cow_spdy:inflate/2 function in cowlib fails to implement output size bounds when passing peer-supplied compressed bytes to zlib:inflate/2. Because the SPDY header compression dictionary is public, an attacker can craft a small SPDY frame (a few kilobytes) that expands to several gigabytes on the BEAM heap, leading to an Out-Of-Memory (OOM) termination of the node. The vulnerability affects the parsers for syn_stream, syn_reply, and headers frame types via cow_spdy:parse_headers/2. The issue was resolved in version 2.16.1 by completely removing the deprecated cow_spdy module.
Affected products
- ninenines cowlib >= 0.1.0, < 2.16.1
Timeline
- 2026-05-13: advisory: Initial publication of GHSA-84f2-rp86-235p
- 2026-05-13: disclosed: CVE-2026-43970 published
- 2026-05-19: patched: GitHub advisory reviewed and updated with patch details