Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-59248— Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS

Quick assessment

Affected
ninenines cowlib
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ninenines cowlib是ninenines的高并发Web服务器中间件。 ninenines cowlib 2.0.0版本至2.19.0之前版本存在资源管理错误漏洞，该漏洞源于HPACK和QPACK前缀整数解码器未限制续传八位字节数量，导致无限制资源分配，可能允许未经身份验证的远程攻击者耗尽内存，造成拒绝服务。

CVSS 8.7 · High EPSS 0.51% · P42

Affected Version Matrix 2

VendorProduct Version RangeStatus
ninenines cowlib 2.0.0-pre.1< 2.19.0 affected
5ddecbc121f812aec53d9df91829448d8e94e44c< f582430498072a0c65ad338030321576dc13a343 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-59248

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS
Source: CVE Program / CVE List V5
Vulnerability Description
Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of service. The HPACK and QPACK prefixed-integer decoder cow_hpack_common:dec_big_int/3 in src/cow_hpack_common.hrl (invoked from cow_hpack:decode/2 in src/cow_hpack.erl and from cow_qpack:decode_field_section/3 in src/cow_qpack.erl) reads continuation octets until it sees one whose high bit is clear, evaluating Int + (Value bsl M) at each step with the shift M growing by seven per octet. No limit is enforced on the number of continuation octets, on the resulting bit width, or on the value; the decoder consumes whatever encoded length the peer supplies. Because Erlang integers are immutable, each intermediate Value bsl M and each accumulator update allocates a fresh bignum whose digit width grows linearly with the number of octets processed so far. Summed across the whole decode, the transient bignum digit materialization is on the order of the square of the encoded length. A single maximal HPACK indexed representation carried inside one HTTP/2 HEADERS plus one CONTINUATION frame at Cowboy's default max_frame_size_received can force hundreds of megabytes of transient allocation and garbage-collection churn before the resulting header-table index is rejected as invalid. Repeated or concurrent connections multiply the pressure and can drive the Erlang VM to memory exhaustion. Cowlib is the HTTP parser used by Cowboy, RabbitMQ's management plugin, and other Erlang and Elixir HTTP/2 and HTTP/3 servers and clients, so any exposed endpoint that accepts HPACK or QPACK from an untrusted peer is reachable. This issue affects cowlib: from 2.0.0 before 2.19.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5
Vulnerability Title
ninenines cowlib 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
ninenines cowlib是ninenines的高并发Web服务器中间件。 ninenines cowlib 2.0.0版本至2.19.0之前版本存在资源管理错误漏洞，该漏洞源于HPACK和QPACK前缀整数解码器未限制续传八位字节数量，导致无限制资源分配，可能允许未经身份验证的远程攻击者耗尽内存，造成拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
ninenines cowlib 2.0.0-pre.1 ~ 2.19.0 cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*
ninenines cowlib 5ddecbc121f812aec53d9df91829448d8e94e44c ~ f582430498072a0c65ad338030321576dc13a343 cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-59248

# POC Description Source Link Shenlong Link
AI-Generated POC Premium
Qwen3.6-35B-A3B · 14741 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-59248

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-59248 (1)

Vendor Advisories for CVE-2026-59248 (2)

IV. Related Vulnerabilities

Same product: cowlib
Same vendor: ninenines
Same weakness: CWE-770

V. Comments for CVE-2026-59248

No comments yet

Leave a comment