CVE-2026-59248

Name of the Vulnerable Software and Affected Versions cowlib versions 2.0.0 through 2.18.x

Description An unauthenticated remote HTTP/2 or HTTP/3 peer can cause a denial of service by exhausting memory on a server or client. The issue exists in the HPACK and QPACK prefixed-integer decoder cow hpack common:dec big int/3 (invoked from cow hpack:decode/2 and cow qpack:decode field section/3), which fails to enforce limits on the number of continuation octets, the resulting bit width, or the final value. Because Erlang integers are immutable, each update allocates a new bignum, leading to transient memory allocation that grows quadratically relative to the encoded length. A single maximal HPACK indexed representation within HTTP/2 HEADERS and CONTINUATION frames can trigger hundreds of megabytes of allocation and garbage-collection churn, potentially leading to Erlang VM memory exhaustion when repeated or concurrent connections are used.

Recommendations Update cowlib to version 2.19.0 or later.