CVE-2026-43970

High

Description

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenines cowlib allows unauthenticated remote denial of service via memory exhaustion. cow_spdy:inflate/2 in cowlib passes peer-supplied compressed bytes directly to zlib:inflate/2 with no output size bound. The SPDY header compression dictionary (?ZDICT) is public, and zlib compresses long runs of repeated bytes at roughly 1024:1, so a few kilobytes of SPDY frame payload can decompress to gigabytes on the BEAM heap, OOM-killing the node. A single unauthenticated SPDY frame is sufficient to trigger the condition. The parsers for syn_stream, syn_reply, and headers frame types are all affected via cow_spdy:parse_headers/2. This issue affects cowlib from 0.1.0 before 2.16.1.

SeverityHigh

CVSS8.2

Exploit probability—

ProductNinenines Cowlib

PublishedMay 13, 2026

First seenMay 13, 2026

Weakness typeCWE-409CWE-409

How to fix

Update

ninenines cowlib2.16.1, 16aad3fb9f81f5cda4d1706ff0c54237c619c282 or later

Patches

github.com/ninenines/cowlib/commit/16aad3fb9f81f5cda4d1706ff0c54237c619c282

Affected products

Product	Affected versions	Fixed in
ninenines cowlib	0.1.0 ≤ v < 2.16.1, fad5c0049df278cc498b6cdb519b09e845a070a8 ≤ v < 16aad3fb9f81f5cda4d1706ff0c54237c619c282	2.16.1, 16aad3fb9f81f5cda4d1706ff0c54237c619c282

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.