Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-28T09:54:19 cowlib: Cowlib: Denial of Service due to unbounded HPACK/QPACK prefixed-integer decoding 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-770

Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of service. The HPACK and QPACK prefixed-integer decoder cow_hpack_common:dec_big_int/3 in src/cow_hpack_common.hrl (invoked from cow_hpack:decode/2 in src/cow_hpack.erl and from cow_qpack:decode_field_section/3 in src/cow_qpack.erl) reads continuation octets until it sees one whose high bit is clear, evaluating Int + (Value bsl M) at each step with the shift M growing by seven per octet. No limit is enforced on the number of continuation octets, on the resulting bit width, or on the value; the decoder consumes whatever encoded length the peer supplies. Because Erlang integers are immutable, each intermediate Value bsl M and each accumulator update allocates a fresh bignum whose digit width grows linearly with the number of octets processed so far. Summed across the whole decode, the transient bignum digit materialization is on the order of the square of the encoded length. A single maximal HPACK indexed representation carried inside one HTTP/2 HEADERS plus one CONTINUATION frame at Cowboy's default max_frame_size_received can force hundreds of megabytes of transient allocation and garbage-collection churn before the resulting header-table index is rejected as invalid. Repeated or concurrent connections multiply the pressure and can drive the Erlang VM to memory exhaustion. Cowlib is the HTTP parser used by Cowboy, RabbitMQ's management plugin, and other Erlang and Elixir HTTP/2 and HTTP/3 servers and clients, so any exposed endpoint that accepts HPACK or QPACK from an untrusted peer is reachable. This issue affects cowlib: from 2.0.0 before 2.19.0.

A flaw was found in cowlib, an HTTP parser. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 frames containing oversized HPACK or QPACK prefixed integers. This unbounded decoding process leads to excessive memory allocation and garbage collection, ultimately causing memory exhaustion and a denial of service (DoS) on the vulnerable server or client.

This is an Important denial of service vulnerability in cowlib, an HTTP parser used by components like RabbitMQ. An unauthenticated remote attacker can exploit this flaw by sending specially crafted HTTP/2 or HTTP/3 frames, leading to unbounded memory allocation and exhaustion, which can cause a service outage. The remote and unauthenticated nature of the attack vector contributes to its Important severity. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Hardened Images 2026-07-28T00:00:00Z RHSA-2026:47231 rabbitmq-server4-3-main-4.3.4-0.2.hum1 Red Hat Hardened Images 2026-07-28T00:00:00Z RHSA-2026:47236 rabbitmq-server4-2-main-4.2.9-0.2.hum1 https://www.cve.org/CVERecord?id=CVE-2026-59248 https://nvd.nist.gov/vuln/detail/CVE-2026-59248 https://cna.erlef.org/cves/CVE-2026-59248.html https://github.com/ninenines/cowlib/commit/f582430498072a0c65ad338030321576dc13a343 https://osv.dev/vulnerability/EEF-CVE-2026-59248