https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 05:05:31 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-318748 EUVD-2026-318748 https://cve.radiocsirt.org/vuln/euvd-2026-318748 https://cve.radiocsirt.org/vuln/fkie_cve-2026-43970 <p>Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenines cowlib allows unauthenticated remote denial of service via memory exhaustion.</p> <p>cow_spdy:inflate/2 in cowlib passes peer-supplied compressed bytes directly to zlib:inflate/2 with no output size bound. The SPDY header compression dictionary (?ZDICT) is public, and zlib compresses long runs of repeated bytes at roughly 1024:1, so a few kilobytes of SPDY frame payload can decompress to gigabytes on the BEAM heap, OOM-killing the node. A single unauthenticated SPDY frame is sufficient to trigger the condition. The parsers for syn_stream, syn_reply, and headers frame types are all affected via cow_spdy:parse_headers/2.</p> <p>This issue affects cowlib from 0.1.0 before 2.16.1.</p> <p>Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenines cowlib allows unauthenticated remote denial of service via memory exhaustion.</p> <p>cow_spdy:inflate/2 in cowlib passes peer-supplied compressed bytes directly to zlib:inflate/2 with no output size bound. The SPDY header compression dictionary (?ZDICT) is public, and zlib compresses long runs of repeated bytes at roughly 1024:1, so a few kilobytes of SPDY frame payload can decompress to gigabytes on the BEAM heap, OOM-killing the node. A single unauthenticated SPDY frame is sufficient to trigger the condition. The parsers for syn_stream, syn_reply, and headers frame types are all affected via cow_spdy:parse_headers/2.</p> <p>This issue affects cowlib from 0.1.0 before 2.16.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-43970 https://cve.radiocsirt.org/vuln/ghsa-84f2-rp86-235p <p><strong>Affected:</strong> Hex: cowlib</p> <p>Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenines cowlib allows unauthenticated remote denial of service via memory exhaustion.</p> <p>cow_spdy:inflate/2 in cowlib passes peer-supplied compressed bytes directly to zlib:inflate/2 with no output size bound. The SPDY header compression dictionary (?ZDICT) is public, and zlib compresses long runs of repeated bytes at roughly 1024:1, so a few kilobytes of SPDY frame payload can decompress to gigabytes on the BEAM heap, OOM-killing the node. A single unauthenticated SPDY frame is sufficient to trigger the condition. The parsers for syn_stream, syn_reply, and headers frame types are all affected via cow_spdy:parse_headers/2.</p> <p>This issue affects cowlib from 0.1.0 before 2.16.1.</p> <p><strong>Affected:</strong> Hex: cowlib</p> <p>Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenines cowlib allows unauthenticated remote denial of service via memory exhaustion.</p> <p>cow_spdy:inflate/2 in cowlib passes peer-supplied compressed bytes directly to zlib:inflate/2 with no output size bound. The SPDY header compression dictionary (?ZDICT) is public, and zlib compresses long runs of repeated bytes at roughly 1024:1, so a few kilobytes of SPDY frame payload can decompress to gigabytes on the BEAM heap, OOM-killing the node. A single unauthenticated SPDY frame is sufficient to trigger the condition. The parsers for syn_stream, syn_reply, and headers frame types are all affected via cow_spdy:parse_headers/2.</p> <p>This issue affects cowlib from 0.1.0 before 2.16.1.</p> https://cve.radiocsirt.org/vuln/ghsa-84f2-rp86-235p https://cve.radiocsirt.org/vuln/msrc_cve-2026-43970 msrc_CVE-2026-43970 https://cve.radiocsirt.org/vuln/msrc_cve-2026-43970 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-43970 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: erlang-cowlib, Ubuntu:18.04:LTS: erlang-cowlib, Ubuntu:20.04:LTS: erlang-cowlib, Ubuntu:22.04:LTS: erlang-cowlib, Ubuntu:24.04:LTS: erlang-cowlib, Ubuntu:25.10: erlang-cowlib, Ubuntu:26.04:LTS: erlang-cowlib</p> <p>Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenines cowlib allows unauthenticated remote denial of service via memory exhaustion. cow_spdy:inflate/2 in cowlib passes peer-supplied compressed bytes directly to zlib:inflate/2 with no output size bound. The SPDY header compression dictionary (?ZDICT) is public, and zlib compresses long runs of repeated bytes at roughly 1024:1, so a few kilobytes of SPDY frame payload can decompress to gigabytes on the BEAM heap, OOM-killing the node. A single unauthenticated SPDY frame is sufficient to trigger the condition. The parsers for syn_stream, syn_reply, and headers frame types are all affected via cow_spdy:parse_headers/2. This issue affects cowlib from 0.1.0 before 2.16.1.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: erlang-cowlib, Ubuntu:18.04:LTS: erlang-cowlib, Ubuntu:20.04:LTS: erlang-cowlib, Ubuntu:22.04:LTS: erlang-cowlib, Ubuntu:24.04:LTS: erlang-cowlib, Ubuntu:25.10: erlang-cowlib, Ubuntu:26.04:LTS: erlang-cowlib</p> <p>Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenines cowlib allows unauthenticated remote denial of service via memory exhaustion. cow_spdy:inflate/2 in cowlib passes peer-supplied compressed bytes directly to zlib:inflate/2 with no output size bound. The SPDY header compression dictionary (?ZDICT) is public, and zlib compresses long runs of repeated bytes at roughly 1024:1, so a few kilobytes of SPDY frame payload can decompress to gigabytes on the BEAM heap, OOM-killing the node. A single unauthenticated SPDY frame is sufficient to trigger the condition. The parsers for syn_stream, syn_reply, and headers frame types are all affected via cow_spdy:parse_headers/2. This issue affects cowlib from 0.1.0 before 2.16.1.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-43970