CVE intelligence

CVE-2026-113431

Vulnerability intelligence

Published Nov 6, 2026Sources checked Nov 11, 2026

8.7HIGHCVSS out of 10

What this means

Review the available evidence

CVE-2026-113431 and is rated High severity with a CVSS score of 8.7. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

What to do next

Remediation and response

Microsoft Security Response Center guidance

Vendor revision: Nov 11, 2026

Release Notes

CISA KEVNot listedBased on the latest collected catalog

EPSS0.4%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-113431?

Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowlib allows an unauthenticated remote peer to exhaust the memory of an HTTP/2 endpoint via HPACK-indexed header fields.

cow_http2_machine:headers_decode/4 in src/cow_http2_machine.erl decodes every HEADERS block with cow_hpack:decode/3. It bounds the compressed block size and the number of fields, but not the size of the decoded header list that RFC 9113 section 6.5.2 places under SETTINGS_MAX_HEADER_LIST_SIZE.

A peer stores one header value of up to the dynamic table size (4096 bytes by default) and then references it with one-byte indexed fields, so about 100 bytes on the wire decode to a header list of about 390 KB. A consumer that copies the decoded values, as Cowboy does when cowboy_http2:headers_to_map/2 joins repeated cookie fields into one binary, allocates that amount for every stream.

The total across streams and connections is not bounded.

This issue affects cowlib: from 2.7.0 before 2.22.0.

Source: NVD