Fedora 43 : erlang-cowboy / erlang-cowlib (2026-ce97d80dae)

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-ce97d80dae advisory. Coordinated security update of cowlib and cowboy, released together upstream on 2026-07-27. cowlib 2.19.0 fixes CVE-2026-59248: unbounded HPACK/QPAC...

CVE-2026-59248

Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server or client and cause a denial of service. The HPACK and QPACK prefixed-integer decoder cowhpackcommon:decbigint/3 in...

EEF-CVE-2026-59248 Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS

Summary Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server or client and cause a denial of service. The HPACK and QPACK prefixed-integer decoder cow\hpack\common:dec\big\int/3 i...

CVE-2026-59248

Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server or client and cause a denial of service. The HPACK and QPACK prefixed-integer decoder cowhpackcommon:decbigint/3 in...

CVE-2026-59248 Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS

Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server or client and cause a denial of service. The HPACK and QPACK prefixed-integer decoder cowhpackcommon:decbigint/3 in...

DEBIAN-CVE-2026-40898

quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.59.1, an attacker can cause excessive memory allocation in quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large trailer field section with many unique field...

CVE-2026-42582 Netty: HTTP/3 QPACK literal unbounded allocation

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final, when decoding header blocks, the non-Huffman branch of io.netty.handler.codec.http3.QpackDecoderdecodeHuffmanEncodedLiteral may execute new bytelength for a string literal before verifying that length byt...