The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote     HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of     service. The HPACK and QPACK prefixed-integer decoder cow_hpack_common:dec_big_int/3 in     src/cow_hpack_common.hrl (invoked from cow_hpack:decode/2 in src/cow_hpack.erl and from     cow_qpack:decode_field_section/3 in src/cow_qpack.erl) reads continuation octets until it sees one whose     high bit is clear, evaluating Int + (Value bsl M) at each step with the shift M growing by seven per     octet. No limit is enforced on the number of continuation octets, on the resulting bit width, or on the     value; the decoder consumes whatever encoded length the peer supplies. Because Erlang integers are     immutable, each intermediate Value bsl M and each accumulator update allocates a fresh bignum whose digit     width grows linearly with the number of octets processed so far. Summed across the whole decode, the     transient bignum digit materialization is on the order of the square of the encoded length. A single     maximal HPACK indexed representation carried inside one HTTP/2 HEADERS plus one CONTINUATION frame at     Cowboy's default max_frame_size_received can force hundreds of megabytes of transient allocation and     garbage-collection churn before the resulting header-table index is rejected as invalid. Repeated or     concurrent connections multiply the pressure and can drive the Erlang VM to memory exhaustion. Cowlib is     the HTTP parser used by Cowboy, RabbitMQ's management plugin, and other Erlang and Elixir HTTP/2 and     HTTP/3 servers and clients, so any exposed endpoint that accepts HPACK or QPACK from an untrusted peer is     reachable. This issue affects cowlib: from 2.0.0 before 2.19.0. (CVE-2026-59248)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-59248

high Nessus Plugin ID 330646

Version 1.3

Version 1.2

Version 1.1

Version 1.3 Aug 5, 2026, 2:10 PM CVSS metrics ("Cvssv4 supplemental" set to "CVSS:4.0/U:Amber") Plugin Feed: 202608051410
Version 1.2 Aug 3, 2026, 9:59 PM CVSS metrics ("CVSSv2 score" set to 6.4) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P") Detection (updated detection logic) Plugin metadata Plugin Feed: 202608032159
Version 1.1 Jul 29, 2026, 9:32 PM New Plugin Feed: 202607292132