EUVD-2026-29200
GHSA-32p9-57cr-4x65
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated remote request over default HTTP/1.1 chunked parsing with low complexity (AV:N/AC:L/PR:N/UI:N); impact is pure availability loss (A:H), no confidentiality or integrity effect.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
Uncontrolled Resource Consumption vulnerability in ninenines cowlib (cow_http_te module) allows Excessive Allocation.
The chunked transfer-encoding parser in cow_http_te accepts an unbounded number of hex digits in the chunk-size field. Each digit causes a bignum multiplication (Len * 16 + digit), so parsing N hex digits requires O(N²) CPU work and O(N) memory. Additionally, when input is drip-fed, the parser discards the accumulated length on each partial read and restarts from zero on resumption, raising the cost to O(N³). An unauthenticated remote attacker can exploit this by sending an HTTP/1.1 request with Transfer-Encoding: chunked and a very long chunk-size hex string to cause denial of service through CPU exhaustion and memory amplification.
This vulnerability is associated with program file src/cow_http_te.erl and program routines cow_http_te:stream_chunked/2, cow_http_te:chunked_len/4.
This issue affects cowlib: from 0.6.0 before 2.16.1.
AnalysisAI
Remote denial of service in ninenines cowlib (the HTTP support library behind the Cowboy web server and Gun client) from 0.6.0 before 2.16.1 lets an unauthenticated attacker exhaust CPU and memory by sending an HTTP/1.1 request whose Transfer-Encoding: chunked chunk-size field contains an unbounded run of hex digits. Each digit triggers a bignum multiply-add, so N digits cost O(N²) CPU and O(N) memory, and because the parser discards accumulated length and restarts on every partial read, drip-feeding the input inflates this to O(N³). There is no public exploit identified at time of analysis and EPSS is very low (0.08%), but the flaw is unauthenticated, network-reachable, and per CISA SSVC automatable.
Technical ContextAI
cowlib is the low-level HTTP/1.1 and HTTP/2 message-parsing library used by the Cowboy HTTP server and the Gun HTTP client in the Erlang/Elixir ecosystem. The defect (CWE-400, Uncontrolled Resource Consumption / Excessive Allocation) lives in src/cow_http_te.erl, specifically cow_http_te:stream_chunked/2 and the recursive hex accumulator cow_http_te:chunked_len/4, which computes the chunk length as Len*16+digit for every hex character with no cap on the number of digits. Because Erlang integers are arbitrary-precision bignums, Len grows without bound, making each successive multiplication more expensive; the vendor fix adds a digit counter (chunked_len/5 with a when D < 16 guard) that stops accumulating after 16 hex digits, which is more than enough for any legitimate chunk size. The upstream test confirms the pre-patch behavior by parsing 16 F's into the value 18446744073709551617.
RemediationAI
Vendor-released patch: upgrade cowlib to 2.16.1 or later (fix commit a4b8039ce8c93ab00867ef6b7e888822c09f4369), which caps the chunk-size parser at 16 hex digits. Because cowlib is usually a transitive dependency, update it through your dependency manager (e.g. bump the cowlib entry via rebar3/mix and confirm the resolved version is >= 2.16.1) and rebuild, since pinning only Cowboy/Gun may not force the cowlib bump. If you cannot patch immediately, place the service behind a reverse proxy or WAF that normalizes or bounds Transfer-Encoding: chunked requests and rejects abnormally long chunk-size lines (trade-off: adds an extra hop and requires the proxy to fully parse chunked framing), and/or enforce strict request-size, header, and connection-time limits plus per-IP rate limiting to blunt CPU/memory amplification (trade-off: aggressive limits may reject large legitimate uploads or slow clients). Reference the advisories at https://cna.erlef.org/cves/CVE-2026-7790.html and https://github.com/ninenines/cowlib/commit/a4b8039ce8c93ab00867ef6b7e888822c09f4369.
Unauthenticated remote denial of service in ninenines cowlib (versions 0.1.0 through 2.16.0) allows a single crafted SPD
Link header directive smuggling in ninenines cowlib (2.9.0+) enables attacker-controlled browsers to initiate out-of-ban
HTTP response splitting in ninenines cowlib allows network-accessible attackers to inject arbitrary HTTP headers when ap
CRLF injection in cowlib's SSE encoder allows an attacker who supplies field values - id, event, data, or comment - cont
CRLF injection in cowlib's cow_cookie:cookie/1 encoder allows an attacker who controls cookie name or value strings to i
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today