Denial of Service Vulnerability in cowlib by ninenines

CVE-2026-43970

What is CVE-2026-43970?

An improper handling of highly compressed data vulnerability in cowlib allows attackers to perform an unauthenticated remote denial of service by exploiting memory exhaustion. This occurs when the cow_spdy:inflate/2 function processes peer-supplied compressed bytes without setting an output size limit. The public SPDY header compression dictionary can lead to significant memory consumption, as a small input can expand dramatically during decompression. This behavior, affecting syn_stream, syn_reply, and headers frame types, could lead to out-of-memory conditions on the BEAM heap, effectively crashing the node with minimal effort.

References