ninenines vulnerabilities

Newest CVEs

• CVE-2026-43971

  Link Header Directive Smuggling via Unescaped target/rel/Attribute Keys in cow_link:link/1

  ninenines · cowlib

  Medium6.3
• CVE-2026-65624

  Cowboy HTTP/1.1 max_headers Bypass via Duplicate Header Names Enables Memory Exhaustion

  ninenines · cowboy

  Medium6.9
• CVE-2026-59248

  Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS

  ninenines · cowlib

  High8.7
• CVE-2026-43966

  HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2

  ninenines · cowlib

  Medium6.3
• CVE-2026-43973

  gun HTTP/1.1 response buffer has no size limit allowing server-controlled memory exhaustion

  ninenines · gun

  High8.7
• CVE-2026-43972

  gun HTTP/2 PUSH_PROMISE authority not validated against connection origin allows cross-origin cookie injection

  ninenines · gun

  Medium6.3
• CVE-2026-43974

  gun HTTP/1.1 client accepts unsolicited 101 Switching Protocols response allowing server-driven protocol hijack and OOM

  ninenines · gun

  High8.7
• CVE-2026-43970

  Decompression Bomb in cow_spdy:inflate/2 Allows Memory Exhaustion via Crafted SPDY Frame

  ninenines · cowlib

  High8.2
• CVE-2026-8466

  Unbounded buffer accumulation in multipart header parsing causes denial of service in cowboy

  ninenines · cowboy

  High8.2
• CVE-2026-43968

  CR Injection in SSE Encoder Enables Event Splitting via cow_sse:event/1

  ninenines · cowlib

  Medium6.3