CVE-2026-59248: cowlib 2.0.0-pre.1 to before 2.19.0

Affected technology

cowlib · 2.0.0-pre.1 to before 2.19.0
ninenines

cowlib · 5ddecbc121f812aec53d9df91829448d8e94e44c to before f582430498072a0c65ad338030321576dc13a343
ninenines

Component: cow_hpack, cow_qpack
Function: cow_hpack:decode/2, cow_qpack:decode_field_section/3
File: src/cow_hpack_common.hrl, src/cow_hpack.erl, src/cow_qpack.erl

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

The source reports that an attacker could disrupt service. Source advisory’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality and integrity impact as none; availability impact as high.