An unbounded HPACK and QPACK prefixed‑integer decoder in cowlib allows an attacker to send HTTP/2 or HTTP/3 frames that cause arbitrarily large temporary allocations. Because the decoder does not enforce limits on the number of continuation octets or the resulting integer size, each decoded byte chain generates a new bignum whose size grows linearly with the chain length, leading to a quadratic growth in transient memory consumption. The attacker can therefore exhaust the Erlang VM’s heap, trigger frequent garbage collection, or crash the process, resulting in a denial of service.

Versions of cowlib from 2.0.0 up to (but not including) 2.19.0 are affected. The vulnerability impacts any Erlang or Elixir service that uses cowlib to process HTTP/2 or HTTP/3 traffic, including Cowboy, RabbitMQ’s management plugin, and other HTTP servers or clients built on top of cowlib. Any publicly exposed endpoint that accepts HPACK or QPACK frames is reachable by an unauthenticated remote peer.

The flaw carries a CVSS score of 8.7, indicating high severity. Its EPSS score is below 1 % and it is not listed in the CISA KEV catalog, suggesting that exploit activity is currently low, but the attack can be performed immediately with a custom packet crafted to use a long prefixed‑integer sequence. The vulnerability is remotely exploitable over the network and does not require authentication, so any external connection that can send HTTP/2 or HTTP/3 data can trigger memory exhaustion. The impact includes possible service unavailability or crashes, which can be amplified by concurrent connections or repeated requests.