Cowlib
Monthly
Unauthenticated remote denial of service in ninenines cowlib (versions 0.1.0 through 2.16.0) allows a single crafted SPDY frame to exhaust BEAM VM memory via a zlib decompression bomb. The cow_spdy:inflate/2 path passes peer-controlled compressed bytes to zlib:inflate/2 without bounding output size, and because the SPDY ?ZDICT dictionary is public and zlib achieves roughly 1024:1 compression on repeated bytes, kilobytes of input expand to gigabytes of heap, OOM-killing the Erlang node. No public exploit identified at time of analysis, EPSS is low (0.14%), and CISA SSVC marks exploitation as none, but the upstream fix is to remove cow_spdy entirely in 2.16.1.
Remote denial of service in ninenines cowlib (the HTTP support library behind the Cowboy web server and Gun client) from 0.6.0 before 2.16.1 lets an unauthenticated attacker exhaust CPU and memory by sending an HTTP/1.1 request whose Transfer-Encoding: chunked chunk-size field contains an unbounded run of hex digits. Each digit triggers a bignum multiply-add, so N digits cost O(N²) CPU and O(N) memory, and because the parser discards accumulated length and restarts on every partial read, drip-feeding the input inflates this to O(N³). There is no public exploit identified at time of analysis and EPSS is very low (0.08%), but the flaw is unauthenticated, network-reachable, and per CISA SSVC automatable.
Link header directive smuggling in ninenines cowlib (2.9.0+) enables attacker-controlled browsers to initiate out-of-band connections to arbitrary origins. The cow_link:do_link/1 function emits target URI, rel values, and attribute keys verbatim into serialized Link headers - a '>' byte in the target prematurely terminates the URI angle-bracket slot, while '"' or '\' in rel breaks out of the quoted-string context, allowing injection of additional synthetic link directives. No public exploit has been identified at time of analysis, but the CVSS 4.0 AT:P metric confirms that exploitation depends on a specific application-level precondition.
HTTP response splitting in ninenines cowlib allows network-accessible attackers to inject arbitrary HTTP headers when applications route untrusted input through the library's structured-field encoder. The root cause is an encoder/decoder asymmetry in cow_http_struct_hd:escape_string/2: it escapes only backslash and double-quote, emitting all other bytes verbatim - including CR (0x0D) and LF (0x0A) - while the matching parser only accepts printable ASCII. Any Cowboy or Gun application that builds a structured HTTP header from attacker-controlled input via cow_http_struct_hd:item/1 or cow_http_hd:wt_protocol/1 is affected. No public exploit has been identified and this CVE does not appear in CISA KEV, but upstream fixes are available as commits to both Cowboy and Gun.
CRLF injection in cowlib's SSE encoder allows an attacker who supplies field values - id, event, data, or comment - containing bare carriage-return (\r) characters to split and forge arbitrary SSE events on receiving clients. Affected are all cowlib deployments from version 2.6.0 used to stream SSE to browser EventSource clients or other SSE consumers that dispatch on event.type or render event.data into the DOM, where the impact is equivalent to stored XSS. No active exploitation is confirmed (not in CISA KEV), EPSS is 0.04% (14th percentile), and SSVC rates automatable as 'no', indicating this is a targeted rather than mass-exploitable flaw; however, applications that echo user-controlled data through SSE fields face meaningful client-side integrity risk.
CRLF injection in cowlib's cow_cookie:cookie/1 encoder allows an attacker who controls cookie name or value strings to inject semicolons, commas, CR, LF, or TAB characters into a serialized Cookie: request header, enabling cookie smuggling and HTTP request header splitting against downstream proxies or servers. Affected applications are those built on cowlib 2.9.0 and later that pass externally-influenced data directly to this function without prior sanitization - notably Cowboy-based Erlang web services acting as reverse proxies or API gateways. No public exploit has been identified and no active exploitation is confirmed; EPSS stands at 0.02% (6th percentile) and CISA KEV status is absent, consistent with SSVC exploitation: none.
Unauthenticated remote denial of service in ninenines cowlib (versions 0.1.0 through 2.16.0) allows a single crafted SPDY frame to exhaust BEAM VM memory via a zlib decompression bomb. The cow_spdy:inflate/2 path passes peer-controlled compressed bytes to zlib:inflate/2 without bounding output size, and because the SPDY ?ZDICT dictionary is public and zlib achieves roughly 1024:1 compression on repeated bytes, kilobytes of input expand to gigabytes of heap, OOM-killing the Erlang node. No public exploit identified at time of analysis, EPSS is low (0.14%), and CISA SSVC marks exploitation as none, but the upstream fix is to remove cow_spdy entirely in 2.16.1.
Remote denial of service in ninenines cowlib (the HTTP support library behind the Cowboy web server and Gun client) from 0.6.0 before 2.16.1 lets an unauthenticated attacker exhaust CPU and memory by sending an HTTP/1.1 request whose Transfer-Encoding: chunked chunk-size field contains an unbounded run of hex digits. Each digit triggers a bignum multiply-add, so N digits cost O(N²) CPU and O(N) memory, and because the parser discards accumulated length and restarts on every partial read, drip-feeding the input inflates this to O(N³). There is no public exploit identified at time of analysis and EPSS is very low (0.08%), but the flaw is unauthenticated, network-reachable, and per CISA SSVC automatable.
Link header directive smuggling in ninenines cowlib (2.9.0+) enables attacker-controlled browsers to initiate out-of-band connections to arbitrary origins. The cow_link:do_link/1 function emits target URI, rel values, and attribute keys verbatim into serialized Link headers - a '>' byte in the target prematurely terminates the URI angle-bracket slot, while '"' or '\' in rel breaks out of the quoted-string context, allowing injection of additional synthetic link directives. No public exploit has been identified at time of analysis, but the CVSS 4.0 AT:P metric confirms that exploitation depends on a specific application-level precondition.
HTTP response splitting in ninenines cowlib allows network-accessible attackers to inject arbitrary HTTP headers when applications route untrusted input through the library's structured-field encoder. The root cause is an encoder/decoder asymmetry in cow_http_struct_hd:escape_string/2: it escapes only backslash and double-quote, emitting all other bytes verbatim - including CR (0x0D) and LF (0x0A) - while the matching parser only accepts printable ASCII. Any Cowboy or Gun application that builds a structured HTTP header from attacker-controlled input via cow_http_struct_hd:item/1 or cow_http_hd:wt_protocol/1 is affected. No public exploit has been identified and this CVE does not appear in CISA KEV, but upstream fixes are available as commits to both Cowboy and Gun.
CRLF injection in cowlib's SSE encoder allows an attacker who supplies field values - id, event, data, or comment - containing bare carriage-return (\r) characters to split and forge arbitrary SSE events on receiving clients. Affected are all cowlib deployments from version 2.6.0 used to stream SSE to browser EventSource clients or other SSE consumers that dispatch on event.type or render event.data into the DOM, where the impact is equivalent to stored XSS. No active exploitation is confirmed (not in CISA KEV), EPSS is 0.04% (14th percentile), and SSVC rates automatable as 'no', indicating this is a targeted rather than mass-exploitable flaw; however, applications that echo user-controlled data through SSE fields face meaningful client-side integrity risk.
CRLF injection in cowlib's cow_cookie:cookie/1 encoder allows an attacker who controls cookie name or value strings to inject semicolons, commas, CR, LF, or TAB characters into a serialized Cookie: request header, enabling cookie smuggling and HTTP request header splitting against downstream proxies or servers. Affected applications are those built on cowlib 2.9.0 and later that pass externally-influenced data directly to this function without prior sanitization - notably Cowboy-based Erlang web services acting as reverse proxies or API gateways. No public exploit has been identified and no active exploitation is confirmed; EPSS stands at 0.02% (6th percentile) and CISA KEV status is absent, consistent with SSVC exploitation: none.