Ninenines
Monthly
Memory exhaustion denial of service in Ninenines Gun (Erlang HTTP client) versions 1.0.0 through 2.3.x allows a malicious or compromised HTTP/1.1 server to crash the entire BEAM node by sending an unterminated response. The gun_http module accumulates incoming bytes into a per-connection buffer without any size ceiling, and since BEAM imposes no default per-process heap limit, a single connection can consume all node memory. No public exploit identified at time of analysis, though the upstream patch and accompanying test cases publicly demonstrate the triggering server behavior.
Denial-of-service in the Erlang HTTP client library Ninenines gun (versions 2.0.0 through 2.3.x) lets a malicious or compromised HTTP/1.1 server force any gun client into raw protocol mode by returning an unsolicited 101 Switching Protocols response, after which the server can flood the client owner process with unbounded gun_data messages and exhaust BEAM VM memory. No public exploit identified at time of analysis, but the fix is trivial and the issue is reachable from any plain HTTP/1.1 request to an attacker-controlled host. CVSS 4.0 8.7 reflects the unauthenticated, network-reachable, high-availability-only impact.
Unauthenticated remote denial of service in ninenines cowlib (versions 0.1.0 through 2.16.0) allows a single crafted SPDY frame to exhaust BEAM VM memory via a zlib decompression bomb. The cow_spdy:inflate/2 path passes peer-controlled compressed bytes to zlib:inflate/2 without bounding output size, and because the SPDY ?ZDICT dictionary is public and zlib achieves roughly 1024:1 compression on repeated bytes, kilobytes of input expand to gigabytes of heap, OOM-killing the Erlang node. No public exploit identified at time of analysis, EPSS is low (0.14%), and CISA SSVC marks exploitation as none, but the upstream fix is to remove cow_spdy entirely in 2.16.1.
Unauthenticated denial of service in ninenines Cowboy 2.0.0 through 2.14.x allows remote attackers to exhaust BEAM VM memory by sending malformed multipart/form-data uploads that never complete a header section. The flaw lives in cowboy_req:read_part/3, which lacked the upper-bound buffer guard already present in read_part_body/4, letting a handful of concurrent slow uploads accumulate request bytes linearly until the Erlang node runs out of memory. EPSS is very low (0.02%) and no public exploit is identified at time of analysis, but the upstream patch and a regression test are already merged in 2.15.0.
Remote denial of service in ninenines cowlib (the HTTP support library behind the Cowboy web server and Gun client) from 0.6.0 before 2.16.1 lets an unauthenticated attacker exhaust CPU and memory by sending an HTTP/1.1 request whose Transfer-Encoding: chunked chunk-size field contains an unbounded run of hex digits. Each digit triggers a bignum multiply-add, so N digits cost O(N²) CPU and O(N) memory, and because the parser discards accumulated length and restarts on every partial read, drip-feeding the input inflates this to O(N³). There is no public exploit identified at time of analysis and EPSS is very low (0.08%), but the flaw is unauthenticated, network-reachable, and per CISA SSVC automatable.
Link header directive smuggling in ninenines cowlib (2.9.0+) enables attacker-controlled browsers to initiate out-of-band connections to arbitrary origins. The cow_link:do_link/1 function emits target URI, rel values, and attribute keys verbatim into serialized Link headers - a '>' byte in the target prematurely terminates the URI angle-bracket slot, while '"' or '\' in rel breaks out of the quoted-string context, allowing injection of additional synthetic link directives. No public exploit has been identified at time of analysis, but the CVSS 4.0 AT:P metric confirms that exploitation depends on a specific application-level precondition.
HTTP response splitting in ninenines cowlib allows network-accessible attackers to inject arbitrary HTTP headers when applications route untrusted input through the library's structured-field encoder. The root cause is an encoder/decoder asymmetry in cow_http_struct_hd:escape_string/2: it escapes only backslash and double-quote, emitting all other bytes verbatim - including CR (0x0D) and LF (0x0A) - while the matching parser only accepts printable ASCII. Any Cowboy or Gun application that builds a structured HTTP header from attacker-controlled input via cow_http_struct_hd:item/1 or cow_http_hd:wt_protocol/1 is affected. No public exploit has been identified and this CVE does not appear in CISA KEV, but upstream fixes are available as commits to both Cowboy and Gun.
Cross-origin cookie injection in ninenines gun (versions 2.0.0 through 2.3.x) allows a malicious or compromised HTTP/2 server to plant cookies scoped to arbitrary third-party domains into the client's shared cookie store. The gun_http2 module fails to validate the :authority pseudo-header in incoming PUSH_PROMISE frames before passing the server-supplied value to the cookie-setting path, violating RFC 7540 §10.6 and RFC 9113 §8.4. This enables session fixation attacks against third-party domains and may lead to account takeover if planted cookies override legitimate session tokens; no public exploit identified at time of analysis. Note: the 'RCE' tag present in source intelligence is not supported by any available data and appears to be erroneous metadata.
CRLF injection in cowlib's SSE encoder allows an attacker who supplies field values - id, event, data, or comment - containing bare carriage-return (\r) characters to split and forge arbitrary SSE events on receiving clients. Affected are all cowlib deployments from version 2.6.0 used to stream SSE to browser EventSource clients or other SSE consumers that dispatch on event.type or render event.data into the DOM, where the impact is equivalent to stored XSS. No active exploitation is confirmed (not in CISA KEV), EPSS is 0.04% (14th percentile), and SSVC rates automatable as 'no', indicating this is a targeted rather than mass-exploitable flaw; however, applications that echo user-controlled data through SSE fields face meaningful client-side integrity risk.
CRLF injection in cowlib's cow_cookie:cookie/1 encoder allows an attacker who controls cookie name or value strings to inject semicolons, commas, CR, LF, or TAB characters into a serialized Cookie: request header, enabling cookie smuggling and HTTP request header splitting against downstream proxies or servers. Affected applications are those built on cowlib 2.9.0 and later that pass externally-influenced data directly to this function without prior sanitization - notably Cowboy-based Erlang web services acting as reverse proxies or API gateways. No public exploit has been identified and no active exploitation is confirmed; EPSS stands at 0.02% (6th percentile) and CISA KEV status is absent, consistent with SSVC exploitation: none.
Memory exhaustion denial of service in Ninenines Gun (Erlang HTTP client) versions 1.0.0 through 2.3.x allows a malicious or compromised HTTP/1.1 server to crash the entire BEAM node by sending an unterminated response. The gun_http module accumulates incoming bytes into a per-connection buffer without any size ceiling, and since BEAM imposes no default per-process heap limit, a single connection can consume all node memory. No public exploit identified at time of analysis, though the upstream patch and accompanying test cases publicly demonstrate the triggering server behavior.
Denial-of-service in the Erlang HTTP client library Ninenines gun (versions 2.0.0 through 2.3.x) lets a malicious or compromised HTTP/1.1 server force any gun client into raw protocol mode by returning an unsolicited 101 Switching Protocols response, after which the server can flood the client owner process with unbounded gun_data messages and exhaust BEAM VM memory. No public exploit identified at time of analysis, but the fix is trivial and the issue is reachable from any plain HTTP/1.1 request to an attacker-controlled host. CVSS 4.0 8.7 reflects the unauthenticated, network-reachable, high-availability-only impact.
Unauthenticated remote denial of service in ninenines cowlib (versions 0.1.0 through 2.16.0) allows a single crafted SPDY frame to exhaust BEAM VM memory via a zlib decompression bomb. The cow_spdy:inflate/2 path passes peer-controlled compressed bytes to zlib:inflate/2 without bounding output size, and because the SPDY ?ZDICT dictionary is public and zlib achieves roughly 1024:1 compression on repeated bytes, kilobytes of input expand to gigabytes of heap, OOM-killing the Erlang node. No public exploit identified at time of analysis, EPSS is low (0.14%), and CISA SSVC marks exploitation as none, but the upstream fix is to remove cow_spdy entirely in 2.16.1.
Unauthenticated denial of service in ninenines Cowboy 2.0.0 through 2.14.x allows remote attackers to exhaust BEAM VM memory by sending malformed multipart/form-data uploads that never complete a header section. The flaw lives in cowboy_req:read_part/3, which lacked the upper-bound buffer guard already present in read_part_body/4, letting a handful of concurrent slow uploads accumulate request bytes linearly until the Erlang node runs out of memory. EPSS is very low (0.02%) and no public exploit is identified at time of analysis, but the upstream patch and a regression test are already merged in 2.15.0.
Remote denial of service in ninenines cowlib (the HTTP support library behind the Cowboy web server and Gun client) from 0.6.0 before 2.16.1 lets an unauthenticated attacker exhaust CPU and memory by sending an HTTP/1.1 request whose Transfer-Encoding: chunked chunk-size field contains an unbounded run of hex digits. Each digit triggers a bignum multiply-add, so N digits cost O(N²) CPU and O(N) memory, and because the parser discards accumulated length and restarts on every partial read, drip-feeding the input inflates this to O(N³). There is no public exploit identified at time of analysis and EPSS is very low (0.08%), but the flaw is unauthenticated, network-reachable, and per CISA SSVC automatable.
Link header directive smuggling in ninenines cowlib (2.9.0+) enables attacker-controlled browsers to initiate out-of-band connections to arbitrary origins. The cow_link:do_link/1 function emits target URI, rel values, and attribute keys verbatim into serialized Link headers - a '>' byte in the target prematurely terminates the URI angle-bracket slot, while '"' or '\' in rel breaks out of the quoted-string context, allowing injection of additional synthetic link directives. No public exploit has been identified at time of analysis, but the CVSS 4.0 AT:P metric confirms that exploitation depends on a specific application-level precondition.
HTTP response splitting in ninenines cowlib allows network-accessible attackers to inject arbitrary HTTP headers when applications route untrusted input through the library's structured-field encoder. The root cause is an encoder/decoder asymmetry in cow_http_struct_hd:escape_string/2: it escapes only backslash and double-quote, emitting all other bytes verbatim - including CR (0x0D) and LF (0x0A) - while the matching parser only accepts printable ASCII. Any Cowboy or Gun application that builds a structured HTTP header from attacker-controlled input via cow_http_struct_hd:item/1 or cow_http_hd:wt_protocol/1 is affected. No public exploit has been identified and this CVE does not appear in CISA KEV, but upstream fixes are available as commits to both Cowboy and Gun.
Cross-origin cookie injection in ninenines gun (versions 2.0.0 through 2.3.x) allows a malicious or compromised HTTP/2 server to plant cookies scoped to arbitrary third-party domains into the client's shared cookie store. The gun_http2 module fails to validate the :authority pseudo-header in incoming PUSH_PROMISE frames before passing the server-supplied value to the cookie-setting path, violating RFC 7540 §10.6 and RFC 9113 §8.4. This enables session fixation attacks against third-party domains and may lead to account takeover if planted cookies override legitimate session tokens; no public exploit identified at time of analysis. Note: the 'RCE' tag present in source intelligence is not supported by any available data and appears to be erroneous metadata.
CRLF injection in cowlib's SSE encoder allows an attacker who supplies field values - id, event, data, or comment - containing bare carriage-return (\r) characters to split and forge arbitrary SSE events on receiving clients. Affected are all cowlib deployments from version 2.6.0 used to stream SSE to browser EventSource clients or other SSE consumers that dispatch on event.type or render event.data into the DOM, where the impact is equivalent to stored XSS. No active exploitation is confirmed (not in CISA KEV), EPSS is 0.04% (14th percentile), and SSVC rates automatable as 'no', indicating this is a targeted rather than mass-exploitable flaw; however, applications that echo user-controlled data through SSE fields face meaningful client-side integrity risk.
CRLF injection in cowlib's cow_cookie:cookie/1 encoder allows an attacker who controls cookie name or value strings to inject semicolons, commas, CR, LF, or TAB characters into a serialized Cookie: request header, enabling cookie smuggling and HTTP request header splitting against downstream proxies or servers. Affected applications are those built on cowlib 2.9.0 and later that pass externally-influenced data directly to this function without prior sanitization - notably Cowboy-based Erlang web services acting as reverse proxies or API gateways. No public exploit has been identified and no active exploitation is confirmed; EPSS stands at 0.02% (6th percentile) and CISA KEV status is absent, consistent with SSVC exploitation: none.