CVE-2026-113431— Unbounded decoded HTTP/2 header-list size in cowlib cow_http2_machine enables HPACK amplification memory exhaustion

Quick assessment

Affected

ninenines cowlib

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ninenines 的 cowlib 组件存在“无限制或无节流机制的资源分配”漏洞，该漏洞允许未认证的远程对等方通过 HPACK 索引头字段耗尽 HTTP/2 端点的内存。具体而言，中的函数会调用解码每一个 HEADERS 数据块。该函数虽然对压缩后数据块的大小和字段数量进行了限制，但并未对 RFC 9113 第 6.5.2 节中由参数所约束的“解码后头列表大小”进行限制。攻击者可以在动态表（默认大小为 4096 字节）中存储一个头字段值，随后通过单字节的索引字段反复引用该值。结果导致约 100 字节的网

CVSS 8.7 · High Updated Nov 06, 2026

Possible ATT&CK Techniques 2 AI

T1499 · Endpoint Denial of Service T1499.003 · Application Exhaustion Flood

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Unbounded decoded HTTP/2 header-list size in cowlib cow_http2_machine enables HPACK amplification memory exhaustion

Source: CVE Program / CVE List V5

Vulnerability Description

Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowlib allows an unauthenticated remote peer to exhaust the memory of an HTTP/2 endpoint via HPACK-indexed header fields. cow_http2_machine:headers_decode/4 in src/cow_http2_machine.erl decodes every HEADERS block with cow_hpack:decode/3. It bounds the compressed block size and the number of fields, but not the size of the decoded header list that RFC 9113 section 6.5.2 places under SETTINGS_MAX_HEADER_LIST_SIZE. A peer stores one header value of up to the dynamic table size (4096 bytes by default) and then references it with one-byte indexed fields, so about 100 bytes on the wire decode to a header list of about 390 KB. A consumer that copies the decoded values, as Cowboy does when cowboy_http2:headers_to_map/2 joins repeated cookie fields into one binary, allocates that amount for every stream. The total across streams and connections is not bounded. This issue affects cowlib: from 2.7.0 onward.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

不加限制或调节的资源分配

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
ninenines	cowlib	2.7.0 ~ *	`cpe:2.3:a:ninenines:cowlib::::::::`
ninenines	cowlib	b461b119e78e4e09bb28b186b09da7ed4a86a0dd ~ a3b15e29b3067644bfd580246c87f7af7a90b3b8	`cpe:2.3:a:ninenines:cowlib::::::::`

II. Public POCs for CVE-2026-113431

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-113431

请登录查看更多情报信息。

Other References for CVE-2026-113431 (4)

https://osv.dev/vulnerability/EEF-CVE-2026-113431 related
https://cna.erlef.org/cves/CVE-2026-113431.html related third-party-advisory
https://github.com/ninenines/cowlib/commit/a3b15e29b3067644bfd580246c87f7af7a90b3b8 patch
https://github.com/ninenines/cowlib/commit/b461b119e78e4e09bb28b186b09da7ed4a86a0dd related

https://www.cve.org/CVERecord?id=CVE-2026-113431

IV. Related Vulnerabilities

Same product: cowlib

Same vendor: ninenines

Same weakness: CWE-770