Ninenines vulnerabilities

Products

• Cowlib 8
• Cowboy 3
• Gun 3

Newest

• ninenines cowboy Cowboy HTTP/1.1 Unbounded Buffering of Pipelined Data During Request Handling Enables Memory Exhaustion CVE-2026-115701 8.2 HighNovember 6, 2026
• ninenines cowlib Unbounded decoded HTTP/2 header-list size in cowlib cow_http2_machine enables HPACK amplification memory exhaustion CVE-2026-113431 8.7 HighNovember 6, 2026
• ninenines cowlib Link Header Directive Smuggling via Unescaped target/rel/Attribute Keys in cow_link:link/1 CVE-2026-43971 Fix available 6.3 MediumAugust 18, 2026
• ninenines cowboy Cowboy HTTP/1.1 max_headers Bypass via Duplicate Header Names Enables Memory Exhaustion CVE-2026-65624 Fix available 6.9 MediumJuly 28, 2026
• ninenines cowlib Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS CVE-2026-59248 Public exploitFix available 8.7 HighJuly 28, 2026
• ninenines cowlib HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2 CVE-2026-43966 Fix available 6.3 MediumJune 8, 2026
• ninenines gun gun HTTP/1.1 response buffer has no size limit allowing server-controlled memory exhaustion CVE-2026-43973 Fix available 8.7 HighJune 8, 2026
• ninenines gun gun HTTP/2 PUSH_PROMISE authority not validated against connection origin allows cross-origin cookie injection CVE-2026-43972 Fix available 6.3 MediumJune 8, 2026
• ninenines gun gun HTTP/1.1 client accepts unsolicited 101 Switching Protocols response allowing server-driven protocol hijack and OOM CVE-2026-43974 Fix available 8.7 HighJune 8, 2026
• ninenines cowlib Decompression Bomb in cow_spdy:inflate/2 Allows Memory Exhaustion via Crafted SPDY Frame CVE-2026-43970 Fix available 8.2 HighMay 13, 2026
• ninenines cowboy Unbounded buffer accumulation in multipart header parsing causes denial of service in cowboy CVE-2026-8466 Fix available 8.2 HighMay 13, 2026
• ninenines cowlib CR Injection in SSE Encoder Enables Event Splitting via cow_sse:event/1 CVE-2026-43968 Fix available 6.3 MediumMay 11, 2026
• ninenines cowlib Unbounded chunk-size hex digits in cowlib cause quadratic CPU and memory DoS CVE-2026-7790 Fix available 8.7 HighMay 11, 2026
• ninenines cowlib Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1 CVE-2026-43969 Fix available 2.1 LowMay 11, 2026