EEF-CVE-2026-43970

See a problem?
Please try reporting it to the source first.

Source

https://cna.erlef.org/osv/EEF-CVE-2026-43970.html

Import Source

https://cna.erlef.org/osv/EEF-CVE-2026-43970.json

JSON Data

https://api.osv.dev/v1/vulns/EEF-CVE-2026-43970

Aliases

Published

2026-05-13T18:43:11Z

Modified

2026-09-08T03:45:06Z

Severity

8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Decompression Bomb in cow_spdy:inflate/2 Allows Memory Exhaustion via Crafted SPDY Frame

Details

Summary

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenines cowlib allows unauthenticated remote denial of service via memory exhaustion.

cow_spdy:inflate/2 in cowlib passes peer-supplied compressed bytes directly to zlib:inflate/2 with no output size bound. The SPDY header compression dictionary (?ZDICT) is public, and zlib compresses long runs of repeated bytes at roughly 1024:1, so a few kilobytes of SPDY frame payload can decompress to gigabytes on the BEAM heap, OOM-killing the node. A single unauthenticated SPDY frame is sufficient to trigger the condition. The parsers for syn_stream, syn_reply, and headers frame types are all affected via cow_spdy:parse_headers/2.

This issue affects cowlib from 0.1.0 before 2.16.1.

Configurations

The application must use cow_spdy:parse/2 to parse SPDY frames from an untrusted peer. cowboy itself does not use cow_spdy; only direct callers of the cow_spdy API are affected.

Solutions

Upgrade to cowlib 2.16.1 or later, in which the cow_spdy module has been removed entirely. No patched version of cow_spdy will be provided. Migrate away from SPDY, which has been deprecated since 2015 in favour of HTTP/2.

Database specific

{
    "capec_ids": [
        "CAPEC-130"
    ],
    "cpe_ids": [
        "cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"
    ],
    "cwe_ids": [
        "CWE-409"
    ]
}

References

Credits

- Peter Ullrich - FINDER
- Loïc Hoguin - REMEDIATION_DEVELOPER

Affected packages

Hex / cowlib

Package

Name: cowlib
Purl: pkg:hex/cowlib

Affected ranges

Type: SEMVER
Events: Introduced

0.1.0

Fixed

2.16.1

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.1.0

1.2.0

1.3.0

2.*

2.0.0

2.0.1

2.1.0

2.2.0

2.2.1

2.3.0

2.4.0

2.5.0

2.5.1

2.6.0

2.7.0

2.7.1

2.7.2

2.7.3

2.8.0

2.9.0

2.9.1

2.10.0

2.10.1

2.11.0

2.12.0

2.12.1

2.13.0

2.14.0

2.15.0

2.16.0

Database specific

source

"https://cna.erlef.org/osv/EEF-CVE-2026-43970.json"

Git / github.com/ninenines/cowlib