Resource Exhaustion in ninenines cowlib Affects HTTP/2 Endpoints

CVE-2026-113431

What is CVE-2026-113431?

The vulnerability in ninenines cowlib involves a potential resource exhaustion scenario in HTTP/2 endpoints. It allows an unauthenticated remote peer to exhaust the memory by exploiting the allocation of oversized decoded header fields. The cow_http2_machine component fails to properly limit the size of the decoded header list, leading to excessive memory allocation without bounds across streams and connections. This issue, present in versions 2.7.0 and later, originates from improper handling of HPACK-indexed header fields, thereby creating significant risks in environments that utilize the affected versions.

References