Description
Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowlib allows an unauthenticated remote peer to exhaust the memory of an HTTP/2 endpoint via HPACK-indexed header fields.

cow_http2_machine:headers_decode/4 in src/cow_http2_machine.erl decodes every HEADERS block with cow_hpack:decode/3. It bounds the compressed block size and the number of fields, but not the size of the decoded header list that RFC 9113 section 6.5.2 places under SETTINGS_MAX_HEADER_LIST_SIZE. A peer stores one header value of up to the dynamic table size (4096 bytes by default) and then references it with one-byte indexed fields, so about 100 bytes on the wire decode to a header list of about 390 KB. A consumer that copies the decoded values, as Cowboy does when cowboy_http2:headers_to_map/2 joins repeated cookie fields into one binary, allocates that amount for every stream. The total across streams and connections is not bounded.

This issue affects cowlib: from 2.7.0 onward.
Published: 2026-11-06
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: Denial of Service via memory exhaustion
Action: Patch Now
AI Analysis

Impact

The vulnerability allows an unauthenticated remote peer to cause a memory exhaustion in an HTTP/2 endpoint by exploiting a lack of bounding on the size of the decoded header list. The attacker can send HPACK-indexed header fields that expand to a large decoded header list, consuming up to several hundred kilobytes per stream. Because the library copies these values into binary maps, the total allocated memory across streams is unbounded, leading to a denial of service. This weakness is a classic case of Allocation of Resources Without Limits or Throttling (CWE-770).

Affected Systems

Vendors: NineNine's cowlib, product: cowlib, version 2.7.0 and later. The issue manifests in any application that uses cowlib with HTTP/2 support, such as servers built on the Cowboy framework. The vulnerability exists as long as the HTTP/2 protocol is enabled and the library is not updated.

Risk and Exploitability

The CVSS score of 8.7 indicates a high severity. The EPSS value is not available, so while exploitation likelihood cannot be quantified, the attack vector is simple: an unauthenticated client can target any accessible HTTP/2 endpoint and send crafted header blocks. The vulnerability is not listed in the CISA KEV catalog, but the lack of a memory bound is sufficient for a successful denial-of-service, especially when multiple concurrent streams amplify the memory usage.

Generated by OpenCVE AI on November 6, 2026 at 11:21 UTC.

Remediation

Vendor Workaround

Cowboy servers that do not need HTTP/2 can set protocols => [http] in the protocol options. The listener then answers the HTTP/2 preface with 501 Not Implemented and the decoder is never reached. Lowering max_headers in the HTTP/2 protocol options shrinks the per-stream allocation in proportion, to about max_headers times the 4096-byte table entry. This reduces the amplification but does not remove it.

OpenCVE Recommended Actions

  • Upgrade to the latest version of cowlib that fixes the unbounded header list size bug.
  • If an upgrade is not immediately possible, configure the server to disable HTTP/2 by setting the protocol options to only [http], which will cause the server to return 501 Not Implemented to any HTTP/2 attempt.
  • Alternatively, lower the max_headers value in the HTTP/2 protocol options to reduce per-stream allocation; use this as a temporary mitigation while monitoring memory usage.
  • Implement runtime monitoring of memory consumption and enforce connection or stream limits to prevent resource exhaustion.

Generated by OpenCVE AI on November 6, 2026 at 11:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 06 Nov 2026 10:30:00 +0000

Type Values Removed Values Added
Description Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowlib allows an unauthenticated remote peer to exhaust the memory of an HTTP/2 endpoint via HPACK-indexed header fields. cow_http2_machine:headers_decode/4 in src/cow_http2_machine.erl decodes every HEADERS block with cow_hpack:decode/3. It bounds the compressed block size and the number of fields, but not the size of the decoded header list that RFC 9113 section 6.5.2 places under SETTINGS_MAX_HEADER_LIST_SIZE. A peer stores one header value of up to the dynamic table size (4096 bytes by default) and then references it with one-byte indexed fields, so about 100 bytes on the wire decode to a header list of about 390 KB. A consumer that copies the decoded values, as Cowboy does when cowboy_http2:headers_to_map/2 joins repeated cookie fields into one binary, allocates that amount for every stream. The total across streams and connections is not bounded. This issue affects cowlib: from 2.7.0 onward.
Title Unbounded decoded HTTP/2 header-list size in cowlib cow_http2_machine enables HPACK amplification memory exhaustion
First Time appeared Ninenines
Ninenines cowlib
Weaknesses CWE-770
CPEs cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*
Vendors & Products Ninenines
Ninenines cowlib
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Ninenines Cowlib
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-11-06T10:28:15.837Z

Reserved: 2026-10-30T12:30:02.006Z

Link: CVE-2026-113431

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-06T11:17:04.410

Modified: 2026-11-06T11:17:04.410

Link: CVE-2026-113431

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-06T13:15:03Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling