{"id":"AZL-113254","summary":"CVE-2026-113431 affecting package rabbitmq-server 3.13.7-11","details":"Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowlib allows an unauthenticated remote peer to exhaust the memory of an HTTP/2 endpoint via HPACK-indexed header fields.\n\ncow_http2_machine:headers_decode/4 in src/cow_http2_machine.erl decodes every HEADERS block with cow_hpack:decode/3. It bounds the compressed block size and the number of fields, but not the size of the decoded header list that RFC 9113 section 6.5.2 places under SETTINGS_MAX_HEADER_LIST_SIZE. A peer stores one header value of up to the dynamic table size (4096 bytes by default) and then references it with one-byte indexed fields, so about 100 bytes on the wire decode to a header list of about 390 KB. A consumer that copies the decoded values, as Cowboy does when cowboy_http2:headers_to_map/2 joins repeated cookie fields into one binary, allocates that amount for every stream. The total across streams and connections is not bounded.\n\nThis issue affects cowlib: from 2.7.0 before 2.22.0.","modified":"2026-11-15T05:30:42Z","published":"2026-11-06T11:17:04Z","upstream":["CVE-2026-113431"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113431"}],"affected":[{"package":{"name":"rabbitmq-server","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/rabbitmq-server"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.13.7-11"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-113254.json"}}],"schema_version":"1.9.2"}