Hex Package Vulnerabilities
Vulnerabilities associated with cowlib.
Packages
Clear package- hackney12 vulnerabilities
- bandit7 vulnerabilities
- tesla5 vulnerabilities
- ash4 vulnerabilities
- cowlib4 vulnerabilities
- gun4 vulnerabilities
- mint4 vulnerabilities
- plug4 vulnerabilities
- rabbit_common4 vulnerabilities
- ewe3 vulnerabilities
- phoenix3 vulnerabilities
- phoenix_storybook3 vulnerabilities
- absinthe2 vulnerabilities
- ash_authentication2 vulnerabilities
- cowboy2 vulnerabilities
- hex_core2 vulnerabilities
- oban_web2 vulnerabilities
- phoenix_html2 vulnerabilities
- pow2 vulnerabilities
- req2 vulnerabilities
- wisp2 vulnerabilities
- MongooseIM1 vulnerability
- RabbitMQ1 vulnerability
- Samly1 vulnerability
- absinthe_plug1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-43970HIGH | Decompression Bomb in cow_spdy:inflate/2 Allows Memory Exhaustion via Crafted SPDY FrameImproper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenines cowlib allows unauthenticated remote denial of service via memory exhaustion. cow_spdy:inflate/2 in cowlib passes peer-supplied compressed bytes directly to zlib:inflate/2 with no output size bound. The SPDY header compression dictionary (?ZDICT) is public, and zlib compresses long runs of repeated bytes at roughly 1024:1, so a few kilobytes of SPDY frame payload can decompress to gigabytes on the BEAM h… CWE-409May 13, 2026 | CVSS8.2v4.0 | EPSS0.511% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-43968MEDIUM | CR Injection in SSE Encoder Enables Event Splitting via cow_sse:event/1Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows SSE event splitting and injection via unvalidated field values. cow_sse:event/1 in cowlib guards the id and event fields against \n but not against bare \r, and the internal prefix_lines/2 function used for data and comment fields splits only on \n. Because the SSE specification requires decoders to treat \r\n, \r, and \n as equivalent line terminators, an attacker who controls any of these fie… CWE-93May 11, 2026 | CVSS6.3v4.0 | EPSS0.266% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-7790HIGH | Unbounded chunk-size hex digits in cowlib cause quadratic CPU and memory DoSUncontrolled Resource Consumption vulnerability in ninenines cowlib (cow_http_te module) allows Excessive Allocation. The chunked transfer-encoding parser in cow_http_te accepts an unbounded number of hex digits in the chunk-size field. Each digit causes a bignum multiplication (Len * 16 + digit), so parsing N hex digits requires O(N²) CPU work and O(N) memory. Additionally, when input is drip-fed, the parser discards the accumulated length on each partial read and restarts from zero on resumpt… CWE-400May 11, 2026 | CVSS8.7v4.0 | EPSS0.431% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows HTTP request splitting and cookie smuggling via unvalidated cookie name and value fields. cow_cookie:cookie/1 in cowlib builds a client-side Cookie: request header from a list of name-value pairs without validating either field. An attacker who controls the cookie names or values passed to this function can inject ;, ,, CR, LF, or TAB characters into the serialized header. This enables two clas… CWE-93May 11, 2026 | CVSS2.1v4.0 | EPSS0.145% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |