CVE-2026-113431

Name of the Vulnerable Software and Affected Versions cowlib versions 2.7.0 and later

Description An unauthenticated remote peer can cause memory exhaustion on an HTTP/2 endpoint. The issue occurs because the cow http2 machine:headers decode/4 function in src/cow http2 machine.erl uses cow hpack:decode/3 to decode HEADERS blocks without enforcing a limit on the size of the decoded header list, ignoring the SETTINGS MAX HEADER LIST SIZE defined in RFC 9113. An attacker can store a large header value (up to 4096 bytes) in the dynamic table and reference it multiple times using one-byte indexed fields. This allows a small amount of network traffic to expand into a large memory allocation. For example, a 110-byte block can decode into a header list of approximately 390 KB. When a consumer, such as Cowboy using cowboy http2:headers to map/2, joins repeated cookie fields into a single binary, it allocates this expanded size for every stream, potentially leading to the Erlang VM running out of memory.

Recommendations For cowlib versions 2.7.0 and later, consider the following mitigations: