UBUNTU-CVE-2026-113431: High severity ubuntu/erlang-cowlib vulnerability
Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowlib allows an unauthenticated remote peer to exhaust the memory of an HTTP/2 endpoint via HPACK-indexed header fields. cowhttp2machine:headersdecode/4 in src/cowhttp2machine.erl decodes every HEADERS block with cowhpack:decode/3. It bounds the compressed block size and the number of fields, but not the size of the decoded header list that RFC 9113 section 6.5.2 places under SETTINGSMAXHEADERLISTSIZE. A peer stores one header value of up to the dynamic table size (4096 bytes by default) and then references it with one-byte indexed fields, so about 100 bytes on the wire decode to a header list of about 390 KB. A consumer that copies the decoded values, as Cowboy does when cowboyhttp2:headerstomap/2 joins repeated cookie fields into one binary, allocates that amount for every stream. The total across streams and connections is not bounded. This issue affects cowlib: from 2.7.0 onward.
Affected Software
Event History
Frequently Asked Questions
Which deployments are most exposed?
HTTP/2 endpoints using cowlib from 2.7.0 onward are affected. Consumers that copy decoded header values are particularly exposed; Cowboy is specifically noted because it joins repeated cookie fields into a binary.
Does exploitation require authentication or interaction from an application user?
No. An unauthenticated remote HTTP/2 peer can trigger the issue without user interaction.
Do the existing HTTP/2 header limits prevent the memory amplification?
No. The implementation limits compressed block size and field count, but does not limit the decoded header-list size. With the default 4096-byte dynamic table, roughly 100 bytes of indexed fields can decode to about 390 KB of headers per stream.