The flaw arises from improper handling of highly compressed data in the cow_spdy:inflate/2 function. A crafted SPDY frame containing a few kilobytes of compressed data can inflate to gigabytes when passed to the BEAM heap, causing an out‑of‑memory crash. This creates an unauthenticated remote denial‑of‑service regardless of the user context, as a single frame is sufficient to trigger the issue. The weakness is a classic data‑amplification scenario (CWE-409).

Affected products are the Erlang/Elixir library cowlib maintained by ninenines. Versions from the initial release 0.1.0 up through any build prior to 2.16.1 contain the vulnerable cow_spdy module. The module was removed entirely in cowlib 2.16.1, and no backport of a patch for older versions will be released.

The CVSS score of 8.2 indicates high severity. No EPSS score is available, so the precise likelihood of exploitation is unknown, but the lack of authentication and the absence of protection on the input mean that an attacker could simply send the payload over the network. The vulnerability is not listed in CISA’s KEV catalog, and no public exploits are reported; however, the potential for large-scale denial of service or resource exhaustion makes it a serious risk in production deployments that continue to support SPDY.