Is CVE-2026-59248 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59248 being exploited in the wild.

How severe is CVE-2026-59248?

Informational severity, with a CVSS score of 8.7, published 28 July 2026.

Which products and versions are affected?

ninenines cowlib 2.0.0 to 2.18.0.

Is there a fix for CVE-2026-59248?

A patch was published on 2026-07-28: Fix committed to ninenines/cowlib repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59248 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-59248?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59248: Ninenines Cowlib denial of service in HPACK and QPACK decoding

CVE-2026-59248 · Severity: info · CVSS 8.7 · Published 2026-07-28

A vulnerability in the Cowlib HTTP library, used by popular Erlang and Elixir web servers like Cowboy and RabbitMQ, could allow an attacker to crash a server. By sending specially crafted HTTP/2 or HTTP/3 requests, an unauthenticated remote user can force the server to consume excessive amounts of memory. This can lead to a denial of service, making the application or service unavailable to legitimate users.

Quick answers

Is CVE-2026-59248 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59248 being exploited in the wild.
How severe is CVE-2026-59248?: Informational severity, with a CVSS score of 8.7, published 28 July 2026.
Which products and versions are affected?: ninenines cowlib 2.0.0 to 2.18.0.
Is there a fix for CVE-2026-59248?: A patch was published on 2026-07-28: Fix committed to ninenines/cowlib repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59248 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-59248?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A resource exhaustion vulnerability exists in cowlib's HPACK and QPACK prefixed-integer decoder (cow_hpack_common:dec_big_int/3). The decoder fails to enforce limits on the number of continuation octets or the resulting bit width when processing encoded integers. Because Erlang integers are immutable, the decoder allocates increasingly large 'bignums' for each intermediate step, leading to quadratic memory allocation relative to the input length. An attacker can exploit this by sending a single maximal HPACK indexed representation within standard frame size limits to trigger hundreds of megabytes of transient memory allocation and garbage collection churn. This issue is fixed in cowlib version 2.19.0.

Affected products

ninenines cowlib 2.0.0 to 2.18.0

Timeline

2026-07-28: advisory: CVE-2026-59248 published by Erlang Ecosystem Foundation
2026-07-28: patched: Fix committed to ninenines/cowlib repository

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.