[From nobody Wed Jul 29 14:09:08 2026 Received: (at submit) by bugs.debian.org; 29 Jul 2026 12:05:31 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-113.6 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,FOURLA, FROMDEVELOPER,MD5_SHA1_SUM,SPF_HELO_NONE,SPF_PASS, USER_IN_DKIM_WELCOMELIST,XMAILER_REPORTBUG autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 44; hammy, 150; neutral, 152; spammy, 0. spammytokens: hammytokens:0.000-+--Hx-spam-relays-external:sk:stravin, 0.000-+--H*RT:sk:stravin, 0.000-+--Hx-spam-relays-external:311, 0.000-+--H*RT:311, 0.000-+--H*RT:108 Return-path: <carnil@debian.org> Received: from stravinsky.debian.org ([2001:41b8:202:deb::311:108]:53800) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <carnil@debian.org>) id 1wp32Q-00D7dX-3B for submit@bugs.debian.org; Wed, 29 Jul 2026 12:05:30 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:Date:Message-ID:Subject:To:From: Content-Transfer-Encoding:MIME-Version:Content-Type:Reply-To:Cc:Content-ID: Content-Description:In-Reply-To:References; bh=OP61czLIVZnwKrhDToWjYVk7UtU+lJZr0h1K3MT37eQ=; b=nr0rs4ee4xpV/y8YQ+3KlXRN0s 4BLObQziMfSq+qUPK7TiUGwsa5rmuKY5ok/UxFPizaGqys3WzsobqQN/rJ529nE46taz42oF6brKz EFVgzefauqERDKiwUNa2dvODP80YIzsEe6rshjIpWD3n3A76RTmzED9+TePXAc9TzcASNuVQePHEl MNlfWT22vsgGDWGB6EKGKwqDq0/GJ0bBMREdLPlERzRfPHN5PIqPf4XtHVmiLp74LH0ZDbJbct9FR o7X7OdI4egEcB6uCpHHfUao61awCvkyUdSBeeYD4EamnIF3UamiuxtW+Yfb1fMsHbO1leWhI7NLhd a4pNbjNQ==; Received: from authenticated-user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <carnil@debian.org>) id 1wp32O-008RFl-0a for submit@bugs.debian.org; Wed, 29 Jul 2026 12:05:29 +0000 Received: from eldamar.lan (localhost [IPv6:::1]) by eldamar.lan (Postfix) with ESMTP id 4E5DBBE2EE7 for <submit@bugs.debian.org>; Wed, 29 Jul 2026 14:05:27 +0200 (CEST) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: Salvatore Bonaccorso <carnil@debian.org> To: Debian Bug Tracking System <submit@bugs.debian.org> Subject: erlang-cowlib: CVE-2026-59248 Message-ID: <178532672726.762921.2080579079590557986.reportbug@eldamar.lan> X-Mailer: reportbug 13.2.0+nmu1 Date: Wed, 29 Jul 2026 14:05:27 +0200 X-Debian-User: carnil Delivered-To: submit@bugs.debian.org Source: erlang-cowlib Version: 2.18.0-1 Severity: important Tags: security upstream X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org> Hi, The following vulnerability was published for erlang-cowlib. CVE-2026-59248[0]: | Allocation of resources without limits vulnerability in ninenines | cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to | exhaust memory on the vulnerable server (or client) and cause a | denial of service. The HPACK and QPACK prefixed-integer decoder | cow_hpack_common:dec_big_int/3 in src/cow_hpack_common.hrl (invoked | from cow_hpack:decode/2 in src/cow_hpack.erl and from | cow_qpack:decode_field_section/3 in src/cow_qpack.erl) reads | continuation octets until it sees one whose high bit is clear, | evaluating Int + (Value bsl M) at each step with the shift M growing | by seven per octet. No limit is enforced on the number of | continuation octets, on the resulting bit width, or on the value; | the decoder consumes whatever encoded length the peer supplies. | Because Erlang integers are immutable, each intermediate Value bsl M | and each accumulator update allocates a fresh bignum whose digit | width grows linearly with the number of octets processed so far. | Summed across the whole decode, the transient bignum digit | materialization is on the order of the square of the encoded length. | A single maximal HPACK indexed representation carried inside one | HTTP/2 HEADERS plus one CONTINUATION frame at Cowboy's default | max_frame_size_received can force hundreds of megabytes of transient | allocation and garbage-collection churn before the resulting header- | table index is rejected as invalid. Repeated or concurrent | connections multiply the pressure and can drive the Erlang VM to | memory exhaustion. Cowlib is the HTTP parser used by Cowboy, | RabbitMQ's management plugin, and other Erlang and Elixir HTTP/2 and | HTTP/3 servers and clients, so any exposed endpoint that accepts | HPACK or QPACK from an untrusted peer is reachable. This issue | affects cowlib: from 2.0.0 before 2.19.0. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-59248 https://www.cve.org/CVERecord?id=CVE-2026-59248 [1] https://cna.erlef.org/cves/CVE-2026-59248.html [2] https://github.com/ninenines/cowlib/commit/f582430498072a0c65ad338030321576dc13a343 Regards, Salvatore ]