Denial of service vulnerability in cowlib affects Erlang HTTP/2 and HTTP/3 servers

CVE-2026-59248

What is CVE-2026-59248?

A resource exhaustion vulnerability in cowlib allows unauthenticated remote HTTP/2 or HTTP/3 peers to exhaust memory on servers or clients. The flaw lies in the HPACK and QPACK prefixed-integer decoder, which does not impose limits on continuation octets and can lead to severe memory allocation issues. As the decoder processes input, it continually allocates immutable Erlang integers, leading to excessive memory usage and potential denial of service conditions. Any service utilizing cowlib, including those run on RabbitMQ and other Erlang or Elixir servers, is at risk, especially when exposed to untrusted connections.

References