Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of service. The HPACK and QPACK prefixed-integer decoder cow_hpack_common:dec_big_int/3 in src/cow_hpack_common.hrl (invoked from cow_hpack:decode/2 in src/cow_hpack.erl and from cow_qpack:decode_field_section/3 in src/cow_qpack.erl) reads continuation octets until it sees one whose high bit is clear, evaluating Int + (Value bsl M) at each step with the shift M growing by seven per octet. No limit is enforced on the number of continuation octets, on the resulting bit width, or on the value; the decoder consumes whatever encoded length the peer supplies. Because Erlang integers are immutable, each intermediate Value bsl M and each accumulator update allocates a fresh bignum whose digit width grows linearly with the number of octets processed so far. Summed across the whole decode, the transient bignum digit materialization is on the order of the square of the encoded length. A single maximal HPACK indexed representation carried inside one HTTP/2 HEADERS plus one CONTINUATION frame at Cowboy's default max_frame_size_received can force hundreds of megabytes of transient allocation and garbage-collection churn before the resulting header-table index is rejected as invalid. Repeated or concurrent connections multiply the pressure and can drive the Erlang VM to memory exhaustion. Cowlib is the HTTP parser used by Cowboy, RabbitMQ's management plugin, and other Erlang and Elixir HTTP/2 and HTTP/3 servers and clients, so any exposed endpoint that accepts HPACK or QPACK from an untrusted peer is reachable. This issue affects cowlib: from 2.0.0 before 2.19.0.

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-7d233ad8b0 advisory.

    Coordinated security update of cowlib and cowboy, released together upstream on 2026-07-27.

    cowlib 2.19.0 fixes CVE-2026-59248: unbounded HPACK/QPACK prefixed-integer decoding allowed a denial of     service. It also rejects empty HTTP/2 CONTINUATION frames and NUL bytes in multipart headers, validates     cookie domain and path, limits cow_cookie:parse_cookie to 100 cookies by default, applies Sec-Websocket-     Version limits to response headers, and enforces a custom max_concurrent_streams immediately.

    cowboy 2.18.0 is the matching release and requires cowlib 2.19.0. It rejects CR in HTTP/1.1 header values,     rejects requests containing a fragment component, rejects HTTP/2 requests where host disagrees with     :authority, adds a max_cookies option to the cowboy_req cookie functions, fixes max_headers handling with     duplicate headers, and fixes the websocket max_inflate_size calculation.

    Note that cowboy 2.18.0 removes concurrent processing of pipelined HTTP/1.1 requests. Applications relying     on that behaviour may see different throughput characteristics.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-ce97d80dae advisory.

    Coordinated security update of cowlib and cowboy, released together upstream on 2026-07-27.

    cowlib 2.19.0 fixes CVE-2026-59248: unbounded HPACK/QPACK prefixed-integer decoding allowed a denial of     service. It also rejects empty HTTP/2 CONTINUATION frames and NUL bytes in multipart headers, validates     cookie domain and path, limits cow_cookie:parse_cookie to 100 cookies by default, applies Sec-Websocket-     Version limits to response headers, and enforces a custom max_concurrent_streams immediately.

    cowboy 2.18.0 is the matching release and requires cowlib 2.19.0. It rejects CR in HTTP/1.1 header values,     rejects requests containing a fragment component, rejects HTTP/2 requests where host disagrees with     :authority, adds a max_cookies option to the cowboy_req cookie functions, fixes max_headers handling with     duplicate headers, and fixes the websocket max_inflate_size calculation.

    Note that cowboy 2.18.0 removes concurrent processing of pipelined HTTP/1.1 requests. Applications relying     on that behaviour may see different throughput characteristics.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote     HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of     service. The HPACK and QPACK prefixed-integer decoder cow_hpack_common:dec_big_int/3 in     src/cow_hpack_common.hrl (invoked from cow_hpack:decode/2 in src/cow_hpack.erl and from     cow_qpack:decode_field_section/3 in src/cow_qpack.erl) reads continuation octets until it sees one whose     high bit is clear, evaluating Int + (Value bsl M) at each step with the shift M growing by seven per     octet. No limit is enforced on the number of continuation octets, on the resulting bit width, or on the     value; the decoder consumes whatever encoded length the peer supplies. Because Erlang integers are     immutable, each intermediate Value bsl M and each accumulator update allocates a fresh bignum whose digit     width grows linearly with the number of octets processed so far. Summed across the whole decode, the     transient bignum digit materialization is on the order of the square of the encoded length. A single     maximal HPACK indexed representation carried inside one HTTP/2 HEADERS plus one CONTINUATION frame at     Cowboy's default max_frame_size_received can force hundreds of megabytes of transient allocation and     garbage-collection churn before the resulting header-table index is rejected as invalid. Repeated or     concurrent connections multiply the pressure and can drive the Erlang VM to memory exhaustion. Cowlib is     the HTTP parser used by Cowboy, RabbitMQ's management plugin, and other Erlang and Elixir HTTP/2 and     HTTP/3 servers and clients, so any exposed endpoint that accepts HPACK or QPACK from an untrusted peer is     reachable. This issue affects cowlib: from 2.0.0 before 2.19.0. (CVE-2026-59248)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
335340	Fedora 44 : erlang-cowboy / erlang-cowlib (2026-7d233ad8b0)	Nessus	Fedora Local Security Checks	Local	high
335329	Fedora 43 : erlang-cowboy / erlang-cowlib (2026-ce97d80dae)	Nessus	Fedora Local Security Checks	Local	high
330646	Linux Distros Unpatched Vulnerability : CVE-2026-59248	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-59248

high

Tenable Plugins

high

high

high