CVE-2026-43970: cowlib Decompression Bomb Vulnerability Leading to Memory Exhaustion
Summary
CVE-2026-43970: Decompression Bomb in cow_spdy:inflate/2 Allows Memory Exhaustion via Crafted SPDY Frame. Affects cowlib across 2 version ranges.
>= 0.1.0, < 2.16.1
>= fad5c0049df278cc498b6cdb519b09e845a070a8, < 16aad3fb9f81f5cda4d1706ff0c54237c619c282
Fixed in 2.16.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
cowlib is an open-source library designed for building web applications in the Erlang ecosystem. It provides essential utilities for handling HTTP and SPDY protocols. The library is widely used due to its efficiency and performance in managing web requests. However, it has a critical vulnerability that allows unauthenticated remote denial of service through memory exhaustion when processing specially crafted SPDY frames.
Vulnerability Detail
The vulnerability arises from the improper handling of highly compressed data in the cow_spdy:inflate/2 function of the cowlib package. It allows an attacker to send a small SPDY frame that, when decompressed, can consume an excessive amount of memory, potentially leading to an out-of-memory (OOM) condition on the server. This issue is particularly severe because it can be triggered by a single unauthenticated SPDY frame, affecting the parsers for syn_stream, syn_reply, and headers frame types. The SPDY header compression dictionary is public, and zlib's compression can amplify data sizes significantly, making this vulnerability critical for applications using cowlib versions from 0.1.0 to below 2.16.1.
How To Fix
Latest published version: 2.21.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.16.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using cow_spdy:parse/2 to parse SPDY frames from untrusted peers. Instead, implement additional validation or filtering of incoming SPDY frames to prevent potential exploitation until the package can be updated.
Conclusion
The CVE-2026-43970 vulnerability in the cowlib package poses a significant risk of memory exhaustion through the processing of crafted SPDY frames. It is crucial for developers using affected versions to update to 2.16.1 or later to mitigate this risk. Implementing workarounds can provide temporary relief until the update is applied.
See every vulnerability recorded for cowlib →
FAQ
CVE-2026-43970 is a vulnerability in the cowlib package that allows for memory exhaustion due to improper handling of compressed SPDY frames.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities without requiring any signup.
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
If an immediate update is not possible, implement a workaround by avoiding the use of cow_spdy:parse/2 for untrusted SPDY frames and consider adding additional validation.
For more information, you can reach out to the maintainers of the cowlib package or consult the community forums related to Erlang and its libraries.
References
Related vulnerabilities
Recent vulnerabilities recorded for cowlib.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
