CVE-2026-113431

Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowlib allows an unauthenticated remote peer to exhaust the memory of an HTTP/2 endpoint via HPACK-indexed header fields. cow_http2_machine:headers_decode/4 in src/cow_http2_machine.erl decodes every HEADERS block with cow_hpack:decode/3. It bounds the compressed block size and the number of fields, but not the size of the decoded header list that RFC 9113 section 6.5.2 places under SETTINGS_MAX_HEADER_LIST_SIZE. A peer stores one header value of up to the dynamic table size (4096 bytes by default) and then references it with one-byte indexed fields, so about 100 bytes on the wire decode to a header list of about 390 KB. A consumer that copies the decoded values, as Cowboy does when cowboy_http2:headers_to_map/2 joins repeated cookie fields into one binary, allocates that amount for every stream. The total across streams and connections is not bounded. This issue affects cowlib: from 2.7.0 onward.

• CWE-770

• https://cna.erlef.org/cves/CVE-2026-113431.html
• https://github.com/ninenines/cowlib/commit/a3b15e29b3067644bfd580246c87f7af7a90b3b8
• https://github.com/ninenines/cowlib/commit/b461b119e78e4e09bb28b186b09da7ed4a86a0dd
• https://osv.dev/vulnerability/EEF-CVE-2026-113431

Published

Nov 6, 2026

Last Modified

Nov 6, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-113409The Ortto plugin for WordPress before 1.0.25 did not escape …4.8
• CVE-2026-11341A flaw has been found in D-Link DWR-M920 up to 1.1.50. The i…6.3
• CVE-2026-113411A vulnerability was found in Nerimity Desktop up to 2.2.2. A…6.3
• CVE-2026-11342A vulnerability has been found in code-projects Hotel and To…7.3
• CVE-2026-113421In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, Thre…7.3
• CVE-2026-113429Legacy (v1 to v3) Actions artifact uploads stored the reques…5.4
• CVE-2026-113436Inefficient Algorithmic Complexity vulnerability in the head…8.7
• CVE-2026-113438Pleasanter provided fails to properly verify passwords in LD…6.9
• CVE-2026-11344A vulnerability was found in code-projects Vehicle Managemen…7.3
• CVE-2026-113440Insufficiently Protected Credentials vulnerability in hackne…6
• CVE-2026-113442Values entered by visitors were placed into the HTML summary…5.3
• CVE-2026-11345An Improper Authentication vulnerability in the /api/Cdn/Get…6.9