Vulnerability GHSA-84f2-rp86-235p
Advisory details are being prepared in the background.
High Risk
HIGH RISK
CVSS Score: 8.0
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
5 months ago
May 13, 2026 at 09:32 PM UTC
cowlib: Decompression Bomb in cow_spdy:inflate/2 Allows Memory Exhaustion via Crafted SPDY Frame
1.0.0 - 2.16.0
1.0.0 - 2.16.0
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
3 hours ago
Unbounded decoded HTTP/2 header-list size in cowlib cow_http2_machine enables HPACK amplification memory exhaustion
2.7.0 - 2.21.0 EEF-CVE-2026-113431
2.7.0 - 2.21.0 EEF-CVE-2026-113431
Unknown
2 months ago
Link Header Directive Smuggling via Unescaped target/rel/Attribute Keys in cow_link:link/1
2.9.0 - 2.19.0 EEF-CVE-2026-43971
2.9.0 - 2.19.0 EEF-CVE-2026-43971
Unknown
3 months ago
Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS
2.0.0 - 2.18.0 EEF-CVE-2026-59248
2.0.0 - 2.18.0 EEF-CVE-2026-59248
Unknown
5 months ago
HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2
2.9.0 - 2.21.0 EEF-CVE-2026-43966
2.9.0 - 2.21.0 EEF-CVE-2026-43966
Unknown
5 months ago
Decompression Bomb in cow_spdy:inflate/2 Allows Memory Exhaustion via Crafted SPDY Frame
1.0.0 - 2.16.0 EEF-CVE-2026-43970
1.0.0 - 2.16.0 EEF-CVE-2026-43970
Impacted packages
Timeline
Published
5 months ago
May 13, 2026 at 09:32 PM UTC
Fixed (2.16.1)
5 months ago
May 12, 2026 at 01:20 PM UTC
Last Modified
5 months ago
May 19, 2026 at 08:26 PM UTC