CVE-2026-59248: Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS
Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of service.
Other sources
Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.13.7-9 - Upgrade
Upgrade
debian/erlang-cowlibto a version that resolves this vulnerability.Fixed in 1.3.0-3Fixed in 2.20.0-1 - Upgrade
Upgrade
cowlibto a version that resolves this vulnerability.Fixed in 2.19.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59248?
The severity of CVE-2026-59248 is rated high with a CVSS score of 8.7.
How do I fix CVE-2026-59248?
To fix CVE-2026-59248, you should update to the latest version of cowlib where the vulnerability has been addressed.
What type of attack does CVE-2026-59248 allow?
CVE-2026-59248 allows an unauthenticated remote attacker to perform a memory-exhaustion denial of service on the server or client.
Which software is affected by CVE-2026-59248?
The vulnerability CVE-2026-59248 affects the cowlib software library.
What is the impact of CVE-2026-59248 on systems?
The impact of CVE-2026-59248 can lead to a denial of service due to resource exhaustion on affected systems.