---
id: "CVE-2026-113431"
page: "https://infrastack.ai/live/CVE-2026-113431"
kind: "vulnerability"
aliases: ["CVE-2026-113431"]
title: "cowlib: HTTP/2 HPACK headers let a remote peer exhaust server memory"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cowboy", "cowlib", "erlang", "http2", "package"]
not_affected_if: ["no-http2", "pre-2.7.0"]
published_at: "2026-11-06T11:17:04+00:00"
first_seen_at: "2026-11-06T11:41:23+00:00"
updated_at: "2026-11-06T11:41:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113431", "first_seen_at": "2026-11-06T11:41:23+00:00"}]
exploit_sources: []
---

# cowlib: HTTP/2 HPACK headers let a remote peer exhaust server memory

Link for people: https://infrastack.ai/live/CVE-2026-113431 (this .md is for agents)

Cowlib's HTTP/2 header decoder does not enforce the decoded header list size limit, so a small compressed HEADERS block expands to about 390 KB. A remote unauthenticated peer can repeat this across streams and connections to exhaust the memory of an HTTP/2 endpoint.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the cowlib version in your Erlang dependencies, for example in `rebar.lock` or `mix.lock`; affected from `2.7.0` onward.
- Check whether your server uses Cowboy or another consumer of cowlib's HTTP/2 machine (`cow_http2_machine`).

## Fix

- cowlib: unknown fixed version in the sources; the linked patch pages are not stated here.

## Timeline

- 2026-11-06T11:41:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113431

## Documents

- [fix] Patch: github.com https://github.com/ninenines/cowlib/commit/a3b15e29b3067644bfd580246c87f7af7a90b3b8
- [fix] Patch: github.com https://github.com/ninenines/cowlib/commit/b461b119e78e4e09bb28b186b09da7ed4a86a0dd

## From the sources

Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowlib allows an unauthenticated remote peer to exhaust the memory of an HTTP/2 endpoint via HPACK-indexed header fields.

cow_http2_machine:headers_decode/4 in src/cow_http2_machine.erl decodes every HEADERS block with cow_hpack:decode/3. It bounds the compressed block size and the number of fields, but not the size of the decoded header list that RFC 9113 section 6.5.2 places under SETTINGS_MAX_HEADER_LIST_SIZE. A peer stores one header value of up to the dynamic table size (4096 bytes by default) and then references it with one-byte indexed fields, so about 100 bytes on the wire decode to a header list of about 390 KB. A consumer that copies the decoded values, as Cowboy does when cowboy_http2:headers_to_map/2 joins repeated cookie fields into one binary, allocates that amount for every stream. The total across streams and connections is not bounded.

This issue affects cowlib: from 2.7.0 onward.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_