Skip to main content
cve.nowby Sazabi
← Hex
HexPackage

cowlib

8 known vulnerabilities (4 high, 3 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
8 · 4 high, 3 medium, 1 low
Registry
Hex

Advisories 8

  • Unbounded decoded HTTP/2 header-list size in cowlib cow_http2_machine enables HPACK amplification memory exhaustion

    Affected: from 2.7.0; from 2.7.0.

  • CVE-2026-43971Medium 6.3

    Link Header Directive Smuggling via Unescaped target/rel/Attribute Keys in cow_link:link/1

    Affected: from 2.9.0, fixed in 2.20.0; from 2.9.0, fixed in 2.20.0.

  • Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS

    Affected: from 2.0.0-pre.1, fixed in 2.19.0; from 2.0.0-pre.1, fixed in 2.19.0.

  • CVE-2026-43966Medium 6.3

    HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2

    Affected: from 2.9.0.

  • Decompression Bomb in cow_spdy:inflate/2 Allows Memory Exhaustion via Crafted SPDY Frame

    Affected: from 0.1.0, fixed in 2.16.1; from 0.1.0, fixed in 2.16.1.

  • CVE-2026-43968Medium 6.3

    CR Injection in SSE Encoder Enables Event Splitting via cow_sse:event/1

    Affected: from 2.6.0, fixed in 2.16.1; from 2.6.0, fixed in 2.16.1.

  • Unbounded chunk-size hex digits in cowlib cause quadratic CPU and memory DoS

    Affected: from 0.6.0, fixed in 2.16.1; from 0.6.0, fixed in 2.16.1.

  • Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1

    Affected: from 2.9.0, fixed in 2.21.0; from 2.9.0, through 2.16.1.