# CVE-2026-7790: ninenines cowlib denial of service in cow_http_te

Source: https://junglewise.ai/threats/cve-2026-7790-ninenines-cowlib-denial-of-service-in-cow-http-te  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-11. Updated: 2026-05-22  
License: CC BY 4.0 with a link back

CVE-2026-7790 · Severity: high · CVSS 8.7 · Published 2026-05-11

A vulnerability in the cowlib library, which is used by web servers like Cowboy to handle HTTP traffic, could allow an attacker to crash the service. By sending a specially crafted web request with an extremely long header, an attacker can force the server to consume excessive processor power and memory. This results in a denial-of-service (DoS) condition, making the website or application unavailable to legitimate users.

Technologies: [Nine Nines Cowlib](https://junglewise.ai/threats/technologies/cowlib). Vendors: [Nine Nines](https://junglewise.ai/threats/vendors/nine-nines).

## Quick answers

**Is CVE-2026-7790 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7790 being exploited in the wild.

**How severe is CVE-2026-7790?** High severity, with a CVSS score of 8.7, published 11 May 2026.

**Which products and versions are affected?** Nine Nines Cowlib >= 0.6.0, < 2.16.1, 0.6.0 to 2.16.0, from 0.6.0 before 2.16.1.

**Is there a fix for CVE-2026-7790?** A patch was published on 2026-05-11: Fixed in version 2.16.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-7790 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-7790?** Check whether you run Nine Nines Cowlib at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An uncontrolled resource consumption vulnerability exists in the cow_http_te module of cowlib due to improper validation of chunk-size hex digits in HTTP/1.1 chunked transfer-encoding. The parser accepts an unbounded number of hex digits, where each digit triggers a bignum multiplication, leading to O(N²) CPU complexity and O(N) memory usage. If the input is drip-fed (sent in small fragments), the complexity increases to O(N³) because the parser restarts the calculation on each partial read. An unauthenticated remote attacker can exploit this to cause a denial of service (DoS) through CPU exhaustion and memory amplification. The issue is fixed in version 2.16.1.

## Affected products

- ninenines cowlib from 0.6.0 before 2.16.1

## Identifiers

- CVE-2026-7790
- GHSA-32p9-57cr-4x65

## Timeline

- 2026-05-11: disclosed
- 2026-05-11: advisory
- 2026-05-11: patched: Fixed in version 2.16.1

## References

- [https://cna.erlef.org/cves/CVE-2026-7790.html](https://cna.erlef.org/cves/CVE-2026-7790.html)
- [https://github.com/ninenines/cowlib/commit/a4b8039ce8c93ab00867ef6b7e888822c09f4369](https://github.com/ninenines/cowlib/commit/a4b8039ce8c93ab00867ef6b7e888822c09f4369)

## Related threats

- [ninenines cowlib HTTP response splitting in structured headers](https://junglewise.ai/threats/cve-2026-43966-ninenines-cowlib-http-response-splitting-in-structured-headers)
- [ninenines cowlib denial of service via SPDY decompression bomb](https://junglewise.ai/threats/cve-2026-43970-ninenines-cowlib-denial-of-service-via-spdy-decompression-bomb)
- [ninenines cowlib CRLF injection in cow_cookie:cookie/1](https://junglewise.ai/threats/cve-2026-43969-ninenines-cowlib-crlf-injection-in-cow-cookie-cookie-1)
- [ninenines cowlib CRLF injection in SSE encoder](https://junglewise.ai/threats/cve-2026-43968-ninenines-cowlib-crlf-injection-in-sse-encoder)