EUVD-2026-118102

Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowlib allows an unauthenticated remote peer to exhaust the memory of an HTTP/2 endpoint via HPACK-indexed header fields. cowhttp2machine:headersdecode/4 in src/cowhttp2machine.erl decodes every HEADERS block with...

CVE-2026-113431

The cowlib library (from version 2.7.0 onward) contains an Allocation of Resources Without Limits or Throttling vulnerability (CWE-770) in the cow_http2_machine component. The root cause is that the headers_decode/4 function fails to bound the size of the decoded header list as required by RFC 91...