Executive brief
A vulnerability in the cowlib library, which is used by web servers like Cowboy to handle HTTP traffic, could allow an attacker to crash the service. By sending a specially crafted web request with an extremely long header, an attacker can force the server to consume excessive processor power and memory. This results in a denial-of-service (DoS) condition, making the website or application unavailable to legitimate users.
Technical details
An uncontrolled resource consumption vulnerability exists in the cow_http_te module of cowlib due to improper validation of chunk-size hex digits in HTTP/1.1 chunked transfer-encoding. The parser accepts an unbounded number of hex digits, where each digit triggers a bignum multiplication, leading to O(N²) CPU complexity and O(N) memory usage. If the input is drip-fed (sent in small fragments), the complexity increases to O(N³) because the parser restarts the calculation on each partial read. An unauthenticated remote attacker can exploit this to cause a denial of service (DoS) through CPU exhaustion and memory amplification. The issue is fixed in version 2.16.1.
Affected products
- ninenines cowlib from 0.6.0 before 2.16.1
Timeline
- 2026-05-11: disclosed
- 2026-05-11: advisory
- 2026-05-11: patched: Fixed in version 2.16.1