[From nobody Fri Jun 19 11:23:06 2026
Received: (at submit) by bugs.debian.org; 14 May 2026 11:41:41 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
 (2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-10.9 required=4.0 tests=BAYES_00,FOURLA,
 FROMDEVELOPER,MD5_SHA1_SUM,NO_RELAYS,XMAILER_REPORTBUG autolearn=ham
 autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 31; hammy, 150; neutral, 66; spammy,
 0. spammytokens: hammytokens:0.000-+--H*F:U*carnil,
 0.000-+--XDebbugsCc, 0.000-+--X-Debbugs-Cc, 0.000-+--HTo:N*Debian,
 0.000-+--H*Ad:N*Bug
Return-path: <carnil@debian.org>
Received: via submission by buxtehude.debian.org with esmtp (Exim 4.96)
 (envelope-from <carnil@debian.org>) id 1wNURe-00Dk2r-1y
 for submit@bugs.debian.org; Thu, 14 May 2026 11:41:40 +0000
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: Salvatore Bonaccorso <carnil@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: erlang-cowlib: CVE-2026-43970
Message-ID: <177875889659.688911.11289099050948406612.reportbug@eldamar.lan>
X-Mailer: reportbug 13.2.0
Date: Thu, 14 May 2026 13:41:36 +0200
Delivered-To: submit@bugs.debian.org

Source: erlang-cowlib
Version: 1.3.0-3
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for erlang-cowlib.

CVE-2026-43970[0]:
| Improper Handling of Highly Compressed Data (Data Amplification)
| vulnerability in ninenines cowlib allows unauthenticated remote
| denial of service via memory exhaustion.  cow_spdy:inflate/2 in
| cowlib passes peer-supplied compressed bytes directly to
| zlib:inflate/2 with no output size bound. The SPDY header
| compression dictionary (?ZDICT) is public, and zlib compresses long
| runs of repeated bytes at roughly 1024:1, so a few kilobytes of SPDY
| frame payload can decompress to gigabytes on the BEAM heap, OOM-
| killing the node. A single unauthenticated SPDY frame is sufficient
| to trigger the condition. The parsers for syn_stream, syn_reply, and
| headers frame types are all affected via cow_spdy:parse_headers/2.
| This issue affects cowlib from 0.1.0 before 2.16.1.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-43970
    https://www.cve.org/CVERecord?id=CVE-2026-43970
[1] https://cna.erlef.org/cves/CVE-2026-43970.html
[2] https://osv.dev/vulnerability/EEF-CVE-2026-43970
[3] https://github.com/ninenines/cowlib/commit/16aad3fb9f81f5cda4d1706ff0c54237c619c282

Regards,
Salvatore
]