Uncontrolled Resource Consumption in Cowlib's HTTP Module from Ninenines

CVE-2026-7790

What is CVE-2026-7790?

An unchecked resource consumption vulnerability exists in the cow_http_te module of Ninenines Cowlib, which can lead to excessive CPU and memory usage. This issue arises from the chunked transfer-encoding parser handling an unbounded number of hex digits in the chunk-size field. When an attacker sends a malicious HTTP/1.1 request with a lengthy chunk-size hex string, it can trigger significant resource exhaustion, potentially resulting in a denial-of-service condition. The vulnerability affects multiple versions of Cowlib before 2.16.1.

References