UBUNTU-CVE-2026-43970

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-43970

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-43970.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-43970

Upstream

CVE-2026-43970

Published

2026-05-13T19:17:00Z

Modified

2026-05-20T22:03:06.282819667Z

Severity

8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenines cowlib allows unauthenticated remote denial of service via memory exhaustion. cowspdy:inflate/2 in cowlib passes peer-supplied compressed bytes directly to zlib:inflate/2 with no output size bound. The SPDY header compression dictionary (?ZDICT) is public, and zlib compresses long runs of repeated bytes at roughly 1024:1, so a few kilobytes of SPDY frame payload can decompress to gigabytes on the BEAM heap, OOM-killing the node. A single unauthenticated SPDY frame is sufficient to trigger the condition. The parsers for synstream, synreply, and headers frame types are all affected via cowspdy:parse_headers/2. This issue affects cowlib from 0.1.0 before 2.16.1.

References

Affected packages

Ubuntu:16.04:LTS

erlang-cowlib

Package

Name: erlang-cowlib
Purl: pkg:deb/ubuntu/erlang-cowlib?arch=source&distro=xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.3.0-1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "erlang-cowlib",
            "binary_version": "1.3.0-1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-43970.json"

Ubuntu:18.04:LTS

erlang-cowlib

Package

Name: erlang-cowlib
Purl: pkg:deb/ubuntu/erlang-cowlib?arch=source&distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.3.0-2

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "erlang-cowlib",
            "binary_version": "1.3.0-2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-43970.json"

Ubuntu:20.04:LTS

erlang-cowlib

Package

Name: erlang-cowlib
Purl: pkg:deb/ubuntu/erlang-cowlib?arch=source&distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.3.0-3

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "erlang-cowlib",
            "binary_version": "1.3.0-3"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-43970.json"

Ubuntu:22.04:LTS

erlang-cowlib

Package

Name: erlang-cowlib
Purl: pkg:deb/ubuntu/erlang-cowlib?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.3.0-3

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "erlang-cowlib",
            "binary_version": "1.3.0-3"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-43970.json"

Ubuntu:24.04:LTS

erlang-cowlib

Package

Name: erlang-cowlib
Purl: pkg:deb/ubuntu/erlang-cowlib?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.3.0-3

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "erlang-cowlib",
            "binary_version": "1.3.0-3"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-43970.json"

Ubuntu:25.10

erlang-cowlib

Package

Name: erlang-cowlib
Purl: pkg:deb/ubuntu/erlang-cowlib?arch=source&distro=questing

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.3.0-3

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "erlang-cowlib",
            "binary_version": "1.3.0-3"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-43970.json"

Ubuntu:26.04:LTS

erlang-cowlib

Package

Name: erlang-cowlib
Purl: pkg:deb/ubuntu/erlang-cowlib?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.3.0-3

1.3.0-3build1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "erlang-cowlib",
            "binary_version": "1.3.0-3build1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-43970.json"