Executive brief
A vulnerability in the Cowlib HTTP library, used by popular Erlang and Elixir web servers like Cowboy and RabbitMQ, could allow an attacker to crash a server. By sending specially crafted HTTP/2 or HTTP/3 requests, an unauthenticated remote user can force the server to consume excessive amounts of memory. This can lead to a denial of service, making the application or service unavailable to legitimate users.
Technical details
A resource exhaustion vulnerability exists in cowlib's HPACK and QPACK prefixed-integer decoder (cow_hpack_common:dec_big_int/3). The decoder fails to enforce limits on the number of continuation octets or the resulting bit width when processing encoded integers. Because Erlang integers are immutable, the decoder allocates increasingly large 'bignums' for each intermediate step, leading to quadratic memory allocation relative to the input length. An attacker can exploit this by sending a single maximal HPACK indexed representation within standard frame size limits to trigger hundreds of megabytes of transient memory allocation and garbage collection churn. This issue is fixed in cowlib version 2.19.0.
Affected products
- ninenines cowlib 2.0.0 to 2.18.0
Timeline
- 2026-07-28: advisory: CVE-2026-59248 published by Erlang Ecosystem Foundation
- 2026-07-28: patched: Fix committed to ninenines/cowlib repository