GHSA-84f2-rp86-235p

Suggest an improvement
Source
https://github.com/advisories/GHSA-84f2-rp86-235p
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-84f2-rp86-235p/GHSA-84f2-rp86-235p.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-84f2-rp86-235p
Aliases
Published
2026-05-13T21:32:06Z
Modified
2026-05-19T20:26:01.036608498Z
Severity
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
cowlib: Decompression Bomb in cow_spdy:inflate/2 Allows Memory Exhaustion via Crafted SPDY Frame
Details

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenines cowlib allows unauthenticated remote denial of service via memory exhaustion.

cowspdy:inflate/2 in cowlib passes peer-supplied compressed bytes directly to zlib:inflate/2 with no output size bound. The SPDY header compression dictionary (?ZDICT) is public, and zlib compresses long runs of repeated bytes at roughly 1024:1, so a few kilobytes of SPDY frame payload can decompress to gigabytes on the BEAM heap, OOM-killing the node. A single unauthenticated SPDY frame is sufficient to trigger the condition. The parsers for synstream, synreply, and headers frame types are all affected via cowspdy:parse_headers/2.

This issue affects cowlib from 0.1.0 before 2.16.1.

Database specific 
{
    "cwe_ids": [
        "CWE-409"
    ],
    "github_reviewed_at": "2026-05-19T20:12:01Z",
    "nvd_published_at": "2026-05-13T19:17:25Z",
    "severity": "HIGH",
    "github_reviewed": true
}
References

Affected packages

Hex / cowlib

Package

Name
cowlib
Purl
pkg:hex/cowlib

Affected ranges

Type
SEMVER
Events
Introduced
0.1.0
Fixed
2.16.1

Affected versions

1.*
1.0.0
1.0.1
1.0.2
1.1.0
1.2.0
1.3.0
2.*
2.0.0
2.0.1
2.1.0
2.2.0
2.2.1
2.3.0
2.4.0
2.5.0
2.5.1
2.6.0
2.7.0
2.7.1
2.7.2
2.7.3
2.8.0
2.9.0
2.9.1
2.10.0
2.10.1
2.11.0
2.12.0
2.12.1
2.13.0
2.14.0
2.15.0
2.16.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-84f2-rp86-235p/GHSA-84f2-rp86-235p.json"