CVE-2026-59248: 
RabbitMQ vulnerability analysis and mitigation

CVE-2026-59248 is an allocation of resources without limits vulnerability (CWE-770) in ninenines cowlib, the HTTP parser library used by Cowboy, RabbitMQ's management plugin, and other Erlang/Elixir HTTP/2 and HTTP/3 servers and clients. An unauthenticated remote peer can exploit the unbounded HPACK/QPACK prefixed-integer decoder to exhaust memory on the vulnerable server or client, causing a denial of service. The vulnerability affects cowlib versions from 2.0.0 up to (but not including) 2.19.0, and was published on July 28, 2026. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling) in the cow_hpack_common:dec_big_int/3 function defined in src/cow_hpack_common.hrl, invoked by both cow_hpack:decode/2 and cow_qpack:decode_field_section/3. The decoder reads HPACK/QPACK prefixed-integer continuation octets in a loop — evaluating Int + (Value bsl M) with M growing by 7 per octet — without enforcing any limit on the number of continuation octets, the resulting bit width, or the final value. Because Erlang integers are immutable, each intermediate Value bsl M computation and accumulator update allocates a fresh bignum whose digit width grows linearly with the number of octets processed; the total transient bignum allocation is therefore quadratic in the encoded length. A single maximal HPACK indexed representation inside one HTTP/2 HEADERS plus one CONTINUATION frame at Cowboy's default max_frame_size_received can force hundreds of megabytes of transient allocation and garbage-collection churn before the resulting header-table index is even rejected as invalid (GitHub Advisory, Red Hat Bugzilla, Cowlib Commit).

Successful exploitation causes denial of service through memory exhaustion and excessive garbage-collection pressure on the Erlang VM. Repeated or concurrent malicious connections multiply the memory pressure and can drive the Erlang VM to full memory exhaustion, taking down any service built on cowlib — including Cowboy HTTP servers and RabbitMQ management plugin endpoints. There is no confidentiality or integrity impact; the vulnerability is purely an availability concern, but it is network-accessible and requires no authentication, making it trivially automatable against any exposed HTTP/2 or HTTP/3 endpoint (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is rated as automatable by NVD SSVC analysis, meaning an attacker can reliably trigger it without manual interaction. The EPSS score is approximately 0.291% (21st percentile), indicating a relatively low near-term exploitation probability. The CVE status is listed as "Deferred" and it has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify internet-facing HTTP/2 or HTTP/3 servers running Cowboy, RabbitMQ management plugin, or other Erlang/Elixir applications that use cowlib versions 2.0.0 through 2.18.x. Tools like Shodan or Censys can be used to find such endpoints by fingerprinting HTTP/2 server headers.
2. Craft malicious HPACK payload: Construct an HPACK-encoded integer using the prefixed-integer format with a large number of continuation octets (each with the high bit set to 1), maximizing the encoded length up to Cowboy's default max_frame_size_received. For example, fill a buffer with 0xFF bytes (each contributing 7 bits with the continuation flag set) to create a maximally long integer encoding.
3. Embed in HTTP/2 HEADERS + CONTINUATION frames: Package the crafted HPACK payload as an indexed header representation inside an HTTP/2 HEADERS frame, optionally followed by a CONTINUATION frame, targeting any HTTP/2 endpoint on the server.
4. Send the request: Transmit the crafted HTTP/2 frames to the target server. The vulnerable dec_big_int/3 decoder will process all continuation octets, allocating quadratically growing bignums before ultimately rejecting the invalid header-table index.
5. Repeat or parallelize: Send multiple concurrent connections with the same payload to multiply memory pressure, driving the Erlang VM toward full memory exhaustion and service unavailability (GitHub Advisory, Cowlib Commit).

• Network: Unusual volume of HTTP/2 HEADERS or CONTINUATION frames from a single or small set of source IPs; connections that send large or malformed HPACK-encoded headers and then disconnect without completing a valid request.
• Process/Runtime: Erlang VM process exhibiting sudden spikes in memory consumption and garbage collection frequency; Erlang scheduler utilization increasing sharply without a corresponding increase in legitimate request throughput; Erlang VM process killed due to max_heap_size limit being exceeded (if configured).
• Logs: Application logs showing repeated HPACK decoding errors or invalid header-table index rejections in rapid succession; Cowboy or RabbitMQ management plugin logs indicating connection resets or abnormal termination events correlated with memory pressure.
• System: Host-level memory exhaustion events (OOM killer activity on Linux) targeting the Erlang VM process; significant increase in system-level garbage collection or swap usage on servers running Cowboy or RabbitMQ.

The primary remediation is to upgrade ninenines cowlib to version 2.19.0 or later, which introduces a hard limit of 38 bits for HPACK/QPACK prefixed-integer decoding in dec_big_int/3, preventing unbounded bignum allocation (Cowlib Commit). Red Hat has issued advisories (RHSA-2026:47231 and RHSA-2026:47236) for affected packages in their ecosystem. As interim workarounds, operators should implement network-level rate limiting and request filtering for malformed HTTP/2 or HTTP/3 frames, enforce stricter limits on HTTP header frame sizes at the load balancer or reverse proxy layer, and monitor for excessive memory consumption and garbage-collection patterns indicative of exploitation attempts (Red Hat Bugzilla).

The vulnerability was reported to the cowlib maintainers by David Hernández, as noted in the fix commit (Cowlib Commit). Red Hat triaged the issue as high severity and opened a Bugzilla tracking entry promptly after disclosure, issuing errata advisories for affected products (Red Hat Bugzilla). No significant broader community or social media discussion has been identified beyond standard vulnerability database aggregation.