CVE-2026-113431: Unbounded decoded HTTP/2 header-list size in cowlib cow_http2_machine enables HPACK amplification memory exhaustion

Published Nov 6, 2026

Updated

Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowlib allows an unauthenticated remote peer to exhaust the memory of an HTTP/2 endpoint via HPACK-indexed header fields.

cowhttp2machine:headersdecode/4 in src/cowhttp2machine.erl decodes every HEADERS block with cowhpack:decode/3. It bounds the compressed block size and the number of fields, but not the size of the decoded header list that RFC 9113 section 6.5.2 places under SETTINGSMAXHEADERLISTSIZE. A peer stores one header value of up to the dynamic table size (4096 bytes by default) and then references it with one-byte indexed fields, so about 100 bytes on the wire decode to a header list of about 390 KB. A consumer that copies the decoded values, as Cowboy does when cowboyhttp2:headerstomap/2 joins repeated cookie fields into one binary, allocates that amount for every stream. The total across streams and connections is not bounded.

This issue affects cowlib: from 2.7.0 onward.

Event History

Nov 6, 2026

CVE Published

via MITRE·10:28 AM

Data Sourced

via MITRE·10:28 AM

DescriptionWeakness

Data Sourced

via NVD·11:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are most exposed to this issue?

HTTP/2 endpoints using cowlib 2.7.0 or later are exposed to unauthenticated remote peers. Memory pressure is especially relevant for consumers that copy decoded header values, including Cowboy when it joins repeated cookie fields into a single binary.

What does an attacker need to do to trigger memory exhaustion?

An attacker needs to connect to an affected HTTP/2 endpoint and send HEADERS blocks containing HPACK-indexed fields. They can place a value in the HPACK dynamic table and repeatedly reference it with small indexed fields, producing a decoded header list far larger than the compressed data sent.

Are the existing compressed-header and field-count limits sufficient protection?

No. The affected decoder limits compressed block size and the number of fields, but does not limit the decoded header-list size required by SETTINGS_MAX_HEADER_LIST_SIZE; decoded allocations can therefore grow substantially despite those limits.

What can be done if patching cannot be performed immediately?

The provided information identifies no complete workaround. Reduce exposure to untrusted HTTP/2 peers where possible and apply limits at surrounding infrastructure to constrain abusive connections or streams, since decoded-header memory use is not bounded across streams and connections.

CVE-2026-113431: Unbounded decoded HTTP/2 header-list size in cowlib cow_http2_machine enables HPACK amplification memory exhaustion

Event History

Frequently Asked Questions

Which deployments are most exposed to this issue?

What does an attacker need to do to trigger memory exhaustion?

Are the existing compressed-header and field-count limits sufficient protection?

What can be done if patching cannot be performed immediately?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are most exposed to this issue?

What does an attacker need to do to trigger memory exhaustion?

Are the existing compressed-header and field-count limits sufficient protection?

What can be done if patching cannot be performed immediately?