{"id":"CVE-2026-113431","kind":"vulnerability","aliases":["CVE-2026-113431"],"related":[],"title":"cowlib: HTTP/2 HPACK headers let a remote peer exhaust server memory","description":"Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowlib allows an unauthenticated remote peer to exhaust the memory of an HTTP/2 endpoint via HPACK-indexed header fields.\n\ncow_http2_machine:headers_decode/4 in src/cow_http2_machine.erl decodes every HEADERS block with cow_hpack:decode/3. It bounds the compressed block size and the number of fields, but not the size of the decoded header list that RFC 9113 section 6.5.2 places under SETTINGS_MAX_HEADER_LIST_SIZE. A peer stores one header value of up to the dynamic table size (4096 bytes by default) and then references it with one-byte indexed fields, so about 100 bytes on the wire decode to a header list of about 390 KB. A consumer that copies the decoded values, as Cowboy does when cowboy_http2:headers_to_map/2 joins repeated cookie fields into one binary, allocates that amount for every stream. The total across streams and connections is not bounded.\n\nThis issue affects cowlib: from 2.7.0 onward.","summary":"Cowlib's HTTP/2 header decoder does not enforce the decoded header list size limit, so a small compressed HEADERS block expands to about 390 KB. A remote unauthenticated peer can repeat this across streams and connections to exhaust the memory of an HTTP/2 endpoint.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cowboy","cowlib","erlang","http2","package"],"not_affected_if":["no-http2","pre-2.7.0"],"how_to_check":"- Check the cowlib version in your Erlang dependencies, for example in `rebar.lock` or `mix.lock`; affected from `2.7.0` onward.\n- Check whether your server uses Cowboy or another consumer of cowlib's HTTP/2 machine (`cow_http2_machine`).","fix":"- cowlib: unknown fixed version in the sources; the linked patch pages are not stated here.","status":"open","published_at":"2026-11-06T11:17:04+00:00","first_seen_at":"2026-11-06T11:41:23+00:00","triaged_at":"2026-11-06T11:41:48+00:00","updated_at":"2026-11-06T11:41:48+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T11:41:48Z","model":"claude-haiku-5-5","output":{"fix":"- cowlib: unknown fixed version in the sources; the linked patch pages are not stated here.","reach":"internet","title":"cowlib: HTTP/2 HPACK headers let a remote peer exhaust server memory","impact":"medium","summary":"Cowlib's HTTP/2 header decoder does not enforce the decoded header list size limit, so a small compressed HEADERS block expands to about 390 KB. A remote unauthenticated peer can repeat this across streams and connections to exhaust the memory of an HTTP/2 endpoint.","audience":"developers","category":"package","nicknames":[],"who_cares":["erlang","cowlib","cowboy","http2"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"remote peer exhausts server memory, causing denial of service","analyst_note":"Find the fixed cowlib version and the patch commits in the NVD references (https://nvd.nist.gov/vuln/detail/CVE-2026-113431) to fill fix and fix_status.","how_to_check":"- Check the cowlib version in your Erlang dependencies, for example in `rebar.lock` or `mix.lock`; affected from `2.7.0` onward.\n- Check whether your server uses Cowboy or another consumer of cowlib's HTTP/2 machine (`cow_http2_machine`).","plain_action":"","needs_analyst":true,"not_affected_if":["no-http2","pre-2.7.0"],"who_is_affected":"Any Erlang service that uses cowlib from version 2.7.0 onward to serve HTTP/2, such as Cowboy-based servers, is exposed to remote unauthenticated peers. The decoded header list is copied per stream, so the risk is greatest where repeated cookie fields are joined. Services that do not serve HTTP/2 through cowlib can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000791,"input_tokens":4526,"output_tokens":676,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-113431':14A,17A '-2026':13A,16A '100':173C '2.7.0':230C '390':46B,185C '4096':157C '6.5.2':136C '9113':134C 'across':55B,218C 'affect':227C 'alloc':67C,210C 'allow':78C 'amount':212C 'binari':209C 'block':42B,107C,116C 'bound':113C,224C 'byte':158C,168C,174C 'compress':40B,115C 'connect':58B,221C 'consum':188C 'cooki':205C 'copi':190C 'cow':97C,109C 'cowboy':18B,195C,198C 'cowlib':1A,19B,23B,77C,228C 'cve':12A,15A 'decod':27B,32B,104C,129C,178C,192C 'decode/3':111C 'decode/4':101C 'default':160C 'dynam':154C 'endpoint':66B,90C 'enforc':30B 'erlang':20B 'everi':105C,214C 'exhaust':9A,60B,84C 'expand':43B 'field':96C,122C,170C,206C 'header':4A,26B,33B,41B,95C,100C,106C,130C,141C,148C,181C,200C 'hpack':3A,93C,110C 'hpack-index':92C 'http/2':2A,25B,65B,89C 'http2':21B,98C,199C 'index':94C,169C 'issu':226C 'join':203C 'kb':47B,186C 'let':5A 'limit':36B,71C 'list':34B,131C,142C,182C 'machin':99C 'map/2':202C 'max':140C 'memori':11A,62B,86C 'ninenin':76C 'number':120C 'one':147C,167C,208C 'one-byt':166C 'onward':231C 'packag':22B 'peer':8A,51B,82C,145C 'place':137C 'refer':163C 'remot':7A,49B,81C 'repeat':53B,204C 'resourc':69C 'rfc':133C 'section':135C 'server':10A 'set':139C 'size':35B,117C,126C,143C,156C 'small':39B 'src/cow_http2_machine.erl':103C 'store':146C 'stream':56B,215C,219C 'tabl':155C 'throttl':73C 'total':217C 'unauthent':50B,80C 'valu':149C,193C 'via':91C 'vulner':74C 'wire':177C 'without':70C","nicknames":[],"mitigations":[],"who_affected":"Any Erlang service that uses cowlib from version 2.7.0 onward to serve HTTP/2, such as Cowboy-based servers, is exposed to remote unauthenticated peers. The decoded header list is copied per stream, so the risk is greatest where repeated cookie fields are joined. Services that do not serve HTTP/2 through cowlib can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cowboy","cowlib","erlang","high","http2","package"],"campaign_type":null,"search_a":"'-113431':14A,17A '-2026':13A,16A 'cowlib':1A 'cve':12A,15A 'exhaust':9A 'header':4A 'hpack':3A 'http/2':2A 'let':5A 'memori':11A 'peer':8A 'remot':7A 'server':10A","search_b":"'390':46B 'across':55B 'block':42B 'compress':40B 'connect':58B 'cowboy':18B 'cowlib':19B,23B 'decod':27B,32B 'endpoint':66B 'enforc':30B 'erlang':20B 'exhaust':60B 'expand':43B 'header':26B,33B,41B 'http/2':25B,65B 'http2':21B 'kb':47B 'limit':36B 'list':34B 'memori':62B 'packag':22B 'peer':51B 'remot':49B 'repeat':53B 'size':35B 'small':39B 'stream':56B 'unauthent':50B","search_c":"'100':173C '2.7.0':230C '390':185C '4096':157C '6.5.2':136C '9113':134C 'across':218C 'affect':227C 'alloc':67C,210C 'allow':78C 'amount':212C 'binari':209C 'block':107C,116C 'bound':113C,224C 'byte':158C,168C,174C 'compress':115C 'connect':221C 'consum':188C 'cooki':205C 'copi':190C 'cow':97C,109C 'cowboy':195C,198C 'cowlib':77C,228C 'decod':104C,129C,178C,192C 'decode/3':111C 'decode/4':101C 'default':160C 'dynam':154C 'endpoint':90C 'everi':105C,214C 'exhaust':84C 'field':96C,122C,170C,206C 'header':95C,100C,106C,130C,141C,148C,181C,200C 'hpack':93C,110C 'hpack-index':92C 'http/2':89C 'http2':98C,199C 'index':94C,169C 'issu':226C 'join':203C 'kb':186C 'limit':71C 'list':131C,142C,182C 'machin':99C 'map/2':202C 'max':140C 'memori':86C 'ninenin':76C 'number':120C 'one':147C,167C,208C 'one-byt':166C 'onward':231C 'peer':82C,145C 'place':137C 'refer':163C 'remot':81C 'repeat':204C 'resourc':69C 'rfc':133C 'section':135C 'set':139C 'size':117C,126C,143C,156C 'src/cow_http2_machine.erl':103C 'store':146C 'stream':215C,219C 'tabl':155C 'throttl':73C 'total':217C 'unauthent':80C 'valu':149C,193C 'via':91C 'vulner':74C 'wire':177C 'without':70C","first_public_at":"2026-11-06T11:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113431","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113431","severity":null,"published_at":"2026-11-06T11:17:04+00:00","modified_at":"2026-11-06T11:17:04+00:00","first_seen_at":"2026-11-06T11:41:23+00:00","fetched_at":"2026-11-06T11:41:23+00:00","note":null}],"documents":[{"id":85879,"url":"https://github.com/ninenines/cowlib/commit/a3b15e29b3067644bfd580246c87f7af7a90b3b8","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":85880,"url":"https://github.com/ninenines/cowlib/commit/b461b119e78e4e09bb28b186b09da7ed4a86a0dd","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}