Unbounded hexadecimal digits in the chunk-size field of HTTP/1.1 chunked transfer-encoding allow an unauthenticated attacker to send a request that forces the cow_http_te parser to perform O(N²) CPU work and O(N) memory allocation per digit, escalating to O(N³) when the input is split across multiple reads. As a result, a malicious attacker can exhaust CPU resources and inflate memory usage, leading to denial of service. This is a classic uncontrolled resource consumption flaw (CWE‑400).

This vulnerability is present in the cowlib library supplied by nine-nines (ninenines). Versions ranging from 0.6.0 up to, but not including, 2.16.1 are affected. cowlib is commonly bundled with the Cowboy HTTP server in Erlang and Elixir applications, so any deployment that utilizes Cowboy with an older cowlib version is potentially vulnerable.

The CVSS score of 8.7 indicates a high severity, while no EPSS value is available, so the current exploitation probability is unknown. The issue is not listed in the CISA KEV catalog, meaning there are no publicly documented active exploits at the time of this report. An attacker would need only to craft a single HTTP/1.1 request with a Transfer‑Encoding: chunked header containing an extremely long hexadecimal chunk-size sequence. Because the vulnerability does not require authentication, it can be triggered from anywhere on a network that the server accepts requests from. In practice, the impact is limited to service availability; however, the high resource consumption could affect other processes on the same host under heavy load.