CVE-2026-113431

{
  "etk_id": "ETK-2026-3715",
  "cve_id": "CVE-2026-113431",
  "display_id": "CVE-2026-113431",
  "ghsa_id": "GHSA-9jxc-cwfw-gpg8",
  "euvd_id": "EUVD-2026-118102",
  "status": "published",
  "anchor_state": "anchored",
  "title": "HTTP/2 header-list memory exhaustion in cowlib",
  "summary": "cowlib 2.7.0 and later can allow an unauthenticated HTTP/2 peer to drive excessive memory use during header decoding. Small encoded header blocks can expand into large decoded header lists, and applications that copy decoded values may increase the resulting allocation. Exposure requires an HTTP/2 endpoint using an affected cowlib version.",
  "mitigation": "Upgrade ninenines/cowlib to a release containing commit a3b15e29b3067644bfd580246c87f7af7a90b3b8. Until deployment is complete, disable HTTP/2 or restrict untrusted HTTP/2 access at the network edge.",
  "vendor": "ninenines",
  "product": "cowlib",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2.7.0, < *"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "*"
      ],
      "package_name": "cowlib",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= b461b119e78e4e09bb28b186b09da7ed4a86a0dd, < a3b15e29b3067644bfd580246c87f7af7a90b3b8"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "a3b15e29b3067644bfd580246c87f7af7a90b3b8"
      ],
      "package_name": "ninenines/cowlib",
      "purl": null
    }
  ],
  "cwes": [
    770
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "mechanism_verified",
  "exploit": false,
  "pipeline_minutes": 26.321284883333334,
  "t0_at": "2026-11-06T10:28:15.837000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-06T11:17:08.521282+00:00",
      "days": 0.03394310511574074,
      "is_lower_bound": false,
      "measured_at": "2026-11-06T10:28:15.837000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-06T10:28:15.837000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-06T10:28:15.837000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-113431"
    }
  }
}