CVE-2026-43970 Decompression Bomb in cow_spdy:inflate/2 Allows Memory Exhaustion via Crafted SPDY Frame

[
  {
    "collectionURL": "https://repo.hex.pm",
    "cpes": [
      "cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "cow_spdy"
    ],
    "packageName": "cowlib",
    "packageURL": "pkg:hex/cowlib",
    "product": "cowlib",
    "programFiles": [
      "src/cow_spdy.erl"
    ],
    "programRoutines": [
      {
        "name": "cow_spdy:parse/2"
      },
      {
        "name": "cow_spdy:inflate/2"
      },
      {
        "name": "cow_spdy:parse_headers/2"
      },
      {
        "name": "cow_spdy:parse_headers/4"
      }
    ],
    "repo": "https://github.com/ninenines/cowlib",
    "vendor": "ninenines",
    "versions": [
      {
        "lessThan": "2.16.1",
        "status": "affected",
        "version": "0.1.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "collectionURL": "https://github.com",
    "cpes": [
      "cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "cow_spdy"
    ],
    "packageName": "ninenines/cowlib",
    "packageURL": "pkg:github/ninenines/cowlib",
    "product": "cowlib",
    "programFiles": [
      "src/cow_spdy.erl"
    ],
    "programRoutines": [
      {
        "name": "cow_spdy:parse/2"
      },
      {
        "name": "cow_spdy:inflate/2"
      },
      {
        "name": "cow_spdy:parse_headers/2"
      },
      {
        "name": "cow_spdy:parse_headers/4"
      }
    ],
    "repo": "https://github.com/ninenines/cowlib",
    "vendor": "ninenines",
    "versions": [
      {
        "lessThan": "16aad3fb9f81f5cda4d1706ff0c54237c619c282",
        "status": "affected",
        "version": "fad5c0049df278cc498b6cdb519b09e845a070a8",
        "versionType": "git"
      }
    ]
  }
]