Denial of service vulnerability in cowlib affects Erlang HTTP/2 and HTTP/3 servers
CVE-2026-59248

8.7HIGH

Key Information:

Vendor

Ninenines

Status
Cowlib
Vendor
CVE Published:
28 July 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-59248?

A resource exhaustion vulnerability in cowlib allows unauthenticated remote HTTP/2 or HTTP/3 peers to exhaust memory on servers or clients. The flaw lies in the HPACK and QPACK prefixed-integer decoder, which does not impose limits on continuation octets and can lead to severe memory allocation issues. As the decoder processes input, it continually allocates immutable Erlang integers, leading to excessive memory usage and potential denial of service conditions. Any service utilizing cowlib, including those run on RabbitMQ and other Erlang or Elixir servers, is at risk, especially when exposed to untrusted connections.

Affected Version(s)

cowlib 2.0.0-pre.1 < 2.19.0

cowlib 5ddecbc121f812aec53d9df91829448d8e94e44c

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

bug-free-broccoli
Created by DarynOngera

References

https://cna.erlef.org/cves/CVE-2026-59248.html
third-party-advisoryrelated
https://osv.dev/vulnerability/EEF-CVE-2026-59248
related
https://github.com/ninenines/cowlib/commit/f582430498072a...
patch

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

David Hernández
Jonatan Männchen / EEF
Loïc Hoguin
Jonatan Männchen / EEF
.