CVE-2026-43970
Published: May 13th, 2026
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenines cowlib allows unauthenticated remote denial of service via memory exhaustion.
cow_spdy:inflate/2 in cowlib passes peer-supplied compressed bytes directly to zlib:inflate/2 with no output size bound. The SPDY header compression dictionary (?ZDICT) is public, and zlib compresses long runs of repeated bytes at roughly 1024:1, so a few kilobytes of SPDY frame payload can decompress to gigabytes on the BEAM heap, OOM-killing the node. A single unauthenticated SPDY frame is sufficient to trigger the condition. The parsers for syn_stream, syn_reply, and headers frame types are all affected via cow_spdy:parse_headers/2.
This issue affects cowlib from 0.1.0 before 2.16.1.
Unknown
CVSS v2:
CVSS v2:
Status
| DocFilters Release | Package | State | Justification | Comment |
|---|---|---|---|---|
| 26.3 | zlib (1.3) | False Positive | Code Not Present | CVE-2026-43970 is a vulnerability in cowlib (ninenines/cowlib), an Erlang HTTP support library, not in the zlib C library. The flaw is in cow_spdy.erl, which calls Erlang’s zlib:inflate/2 against attacker-controlled SPDY-compressed headers without any output-size limit. The upstream fix (commit 16aad3fb9f81f5cda4d1706ff0c54237c619c282) deletes the entire cow_spdy module and contains no C code changes. The ‘zlib’ association exists only because cow_spdy used Erlang’s zlib NIF for SPDY header decompression. Document Filters does not use Erlang/OTP, cowlib, cowboy, or any SPDY protocol implementation, and does not perform unbounded decompression of attacker-controlled streams. |
| 26.2 | zlib (1.3) | False Positive | Code Not Present | CVE-2026-43970 is a vulnerability in cowlib (ninenines/cowlib), an Erlang HTTP support library, not in the zlib C library. The flaw is in cow_spdy.erl, which calls Erlang’s zlib:inflate/2 against attacker-controlled SPDY-compressed headers without any output-size limit. The upstream fix (commit 16aad3fb9f81f5cda4d1706ff0c54237c619c282) deletes the entire cow_spdy module and contains no C code changes. The ‘zlib’ association exists only because cow_spdy used Erlang’s zlib NIF for SPDY header decompression. Document Filters does not use Erlang/OTP, cowlib, cowboy, or any SPDY protocol implementation, and does not perform unbounded decompression of attacker-controlled streams. |
| 26.1 | zlib (1.3) | False Positive | Code Not Present | CVE-2026-43970 is a vulnerability in cowlib (ninenines/cowlib), an Erlang HTTP support library, not in the zlib C library. The flaw is in cow_spdy.erl, which calls Erlang’s zlib:inflate/2 against attacker-controlled SPDY-compressed headers without any output-size limit. The upstream fix (commit 16aad3fb9f81f5cda4d1706ff0c54237c619c282) deletes the entire cow_spdy module and contains no C code changes. The ‘zlib’ association exists only because cow_spdy used Erlang’s zlib NIF for SPDY header decompression. Document Filters does not use Erlang/OTP, cowlib, cowboy, or any SPDY protocol implementation, and does not perform unbounded decompression of attacker-controlled streams. |
| 25.4 | zlib (1.3) | False Positive | Code Not Present | CVE-2026-43970 is a vulnerability in cowlib (ninenines/cowlib), an Erlang HTTP support library, not in the zlib C library. The flaw is in cow_spdy.erl, which calls Erlang’s zlib:inflate/2 against attacker-controlled SPDY-compressed headers without any output-size limit. The upstream fix (commit 16aad3fb9f81f5cda4d1706ff0c54237c619c282) deletes the entire cow_spdy module and contains no C code changes. The ‘zlib’ association exists only because cow_spdy used Erlang’s zlib NIF for SPDY header decompression. Document Filters does not use Erlang/OTP, cowlib, cowboy, or any SPDY protocol implementation, and does not perform unbounded decompression of attacker-controlled streams. |
| 25.3 | zlib (1.3) | False Positive | Code Not Present | CVE-2026-43970 is a vulnerability in cowlib (ninenines/cowlib), an Erlang HTTP support library, not in the zlib C library. The flaw is in cow_spdy.erl, which calls Erlang’s zlib:inflate/2 against attacker-controlled SPDY-compressed headers without any output-size limit. The upstream fix (commit 16aad3fb9f81f5cda4d1706ff0c54237c619c282) deletes the entire cow_spdy module and contains no C code changes. The ‘zlib’ association exists only because cow_spdy used Erlang’s zlib NIF for SPDY header decompression. Document Filters does not use Erlang/OTP, cowlib, cowboy, or any SPDY protocol implementation, and does not perform unbounded decompression of attacker-controlled streams. |
| 25.2 | zlib (1.3) | False Positive | Code Not Present | CVE-2026-43970 is a vulnerability in cowlib (ninenines/cowlib), an Erlang HTTP support library, not in the zlib C library. The flaw is in cow_spdy.erl, which calls Erlang’s zlib:inflate/2 against attacker-controlled SPDY-compressed headers without any output-size limit. The upstream fix (commit 16aad3fb9f81f5cda4d1706ff0c54237c619c282) deletes the entire cow_spdy module and contains no C code changes. The ‘zlib’ association exists only because cow_spdy used Erlang’s zlib NIF for SPDY header decompression. Document Filters does not use Erlang/OTP, cowlib, cowboy, or any SPDY protocol implementation, and does not perform unbounded decompression of attacker-controlled streams. |
| 25.1 | zlib (1.3) | False Positive | Code Not Present | CVE-2026-43970 is a vulnerability in cowlib (ninenines/cowlib), an Erlang HTTP support library, not in the zlib C library. The flaw is in cow_spdy.erl, which calls Erlang’s zlib:inflate/2 against attacker-controlled SPDY-compressed headers without any output-size limit. The upstream fix (commit 16aad3fb9f81f5cda4d1706ff0c54237c619c282) deletes the entire cow_spdy module and contains no C code changes. The ‘zlib’ association exists only because cow_spdy used Erlang’s zlib NIF for SPDY header decompression. Document Filters does not use Erlang/OTP, cowlib, cowboy, or any SPDY protocol implementation, and does not perform unbounded decompression of attacker-controlled streams. |
| 24.4 | zlib (1.3) | False Positive | Code Not Present | CVE-2026-43970 is a vulnerability in cowlib (ninenines/cowlib), an Erlang HTTP support library, not in the zlib C library. The flaw is in cow_spdy.erl, which calls Erlang’s zlib:inflate/2 against attacker-controlled SPDY-compressed headers without any output-size limit. The upstream fix (commit 16aad3fb9f81f5cda4d1706ff0c54237c619c282) deletes the entire cow_spdy module and contains no C code changes. The ‘zlib’ association exists only because cow_spdy used Erlang’s zlib NIF for SPDY header decompression. Document Filters does not use Erlang/OTP, cowlib, cowboy, or any SPDY protocol implementation, and does not perform unbounded decompression of attacker-controlled streams. |
| 24.4.0 | zlib (1.3) | False Positive | Code Not Present | CVE-2026-43970 is a vulnerability in cowlib (ninenines/cowlib), an Erlang HTTP support library, not in the zlib C library. The flaw is in cow_spdy.erl, which calls Erlang’s zlib:inflate/2 against attacker-controlled SPDY-compressed headers without any output-size limit. The upstream fix (commit 16aad3fb9f81f5cda4d1706ff0c54237c619c282) deletes the entire cow_spdy module and contains no C code changes. The ‘zlib’ association exists only because cow_spdy used Erlang’s zlib NIF for SPDY header decompression. Document Filters does not use Erlang/OTP, cowlib, cowboy, or any SPDY protocol implementation, and does not perform unbounded decompression of attacker-controlled streams. |
| 24.3 | zlib (1.3) | False Positive | Code Not Present | CVE-2026-43970 is a vulnerability in cowlib (ninenines/cowlib), an Erlang HTTP support library, not in the zlib C library. The flaw is in cow_spdy.erl, which calls Erlang’s zlib:inflate/2 against attacker-controlled SPDY-compressed headers without any output-size limit. The upstream fix (commit 16aad3fb9f81f5cda4d1706ff0c54237c619c282) deletes the entire cow_spdy module and contains no C code changes. The ‘zlib’ association exists only because cow_spdy used Erlang’s zlib NIF for SPDY header decompression. Document Filters does not use Erlang/OTP, cowlib, cowboy, or any SPDY protocol implementation, and does not perform unbounded decompression of attacker-controlled streams. |
| 24.2 | zlib (1.3) | False Positive | Code Not Present | CVE-2026-43970 is a vulnerability in cowlib (ninenines/cowlib), an Erlang HTTP support library, not in the zlib C library. The flaw is in cow_spdy.erl, which calls Erlang’s zlib:inflate/2 against attacker-controlled SPDY-compressed headers without any output-size limit. The upstream fix (commit 16aad3fb9f81f5cda4d1706ff0c54237c619c282) deletes the entire cow_spdy module and contains no C code changes. The ‘zlib’ association exists only because cow_spdy used Erlang’s zlib NIF for SPDY header decompression. Document Filters does not use Erlang/OTP, cowlib, cowboy, or any SPDY protocol implementation, and does not perform unbounded decompression of attacker-controlled streams. |
| 24.1 | zlib (1.3) | False Positive | Code Not Present | CVE-2026-43970 is a vulnerability in cowlib (ninenines/cowlib), an Erlang HTTP support library, not in the zlib C library. The flaw is in cow_spdy.erl, which calls Erlang’s zlib:inflate/2 against attacker-controlled SPDY-compressed headers without any output-size limit. The upstream fix (commit 16aad3fb9f81f5cda4d1706ff0c54237c619c282) deletes the entire cow_spdy module and contains no C code changes. The ‘zlib’ association exists only because cow_spdy used Erlang’s zlib NIF for SPDY header decompression. Document Filters does not use Erlang/OTP, cowlib, cowboy, or any SPDY protocol implementation, and does not perform unbounded decompression of attacker-controlled streams. |
| 23.3 | zlib (1.3) | False Positive | Code Not Present | CVE-2026-43970 is a vulnerability in cowlib (ninenines/cowlib), an Erlang HTTP support library, not in the zlib C library. The flaw is in cow_spdy.erl, which calls Erlang’s zlib:inflate/2 against attacker-controlled SPDY-compressed headers without any output-size limit. The upstream fix (commit 16aad3fb9f81f5cda4d1706ff0c54237c619c282) deletes the entire cow_spdy module and contains no C code changes. The ‘zlib’ association exists only because cow_spdy used Erlang’s zlib NIF for SPDY header decompression. Document Filters does not use Erlang/OTP, cowlib, cowboy, or any SPDY protocol implementation, and does not perform unbounded decompression of attacker-controlled streams. |
| 23.2 | zlib (1.2.12) | False Positive | Code Not Present | CVE-2026-43970 is a vulnerability in cowlib (ninenines/cowlib), an Erlang HTTP support library, not in the zlib C library. The flaw is in cow_spdy.erl, which calls Erlang’s zlib:inflate/2 against attacker-controlled SPDY-compressed headers without any output-size limit. The upstream fix (commit 16aad3fb9f81f5cda4d1706ff0c54237c619c282) deletes the entire cow_spdy module and contains no C code changes. The ‘zlib’ association exists only because cow_spdy used Erlang’s zlib NIF for SPDY header decompression. Document Filters does not use Erlang/OTP, cowlib, cowboy, or any SPDY protocol implementation, and does not perform unbounded decompression of attacker-controlled streams. |
| 23.1 | zlib (1.2.12) | False Positive | Code Not Present | CVE-2026-43970 is a vulnerability in cowlib (ninenines/cowlib), an Erlang HTTP support library, not in the zlib C library. The flaw is in cow_spdy.erl, which calls Erlang’s zlib:inflate/2 against attacker-controlled SPDY-compressed headers without any output-size limit. The upstream fix (commit 16aad3fb9f81f5cda4d1706ff0c54237c619c282) deletes the entire cow_spdy module and contains no C code changes. The ‘zlib’ association exists only because cow_spdy used Erlang’s zlib NIF for SPDY header decompression. Document Filters does not use Erlang/OTP, cowlib, cowboy, or any SPDY protocol implementation, and does not perform unbounded decompression of attacker-controlled streams. |
| 22.4 | zlib (1.2.12) | False Positive | Code Not Present | CVE-2026-43970 is a vulnerability in cowlib (ninenines/cowlib), an Erlang HTTP support library, not in the zlib C library. The flaw is in cow_spdy.erl, which calls Erlang’s zlib:inflate/2 against attacker-controlled SPDY-compressed headers without any output-size limit. The upstream fix (commit 16aad3fb9f81f5cda4d1706ff0c54237c619c282) deletes the entire cow_spdy module and contains no C code changes. The ‘zlib’ association exists only because cow_spdy used Erlang’s zlib NIF for SPDY header decompression. Document Filters does not use Erlang/OTP, cowlib, cowboy, or any SPDY protocol implementation, and does not perform unbounded decompression of attacker-controlled streams. |
| 22.3 | zlib (1.2.12) | False Positive | Code Not Present | CVE-2026-43970 is a vulnerability in cowlib (ninenines/cowlib), an Erlang HTTP support library, not in the zlib C library. The flaw is in cow_spdy.erl, which calls Erlang’s zlib:inflate/2 against attacker-controlled SPDY-compressed headers without any output-size limit. The upstream fix (commit 16aad3fb9f81f5cda4d1706ff0c54237c619c282) deletes the entire cow_spdy module and contains no C code changes. The ‘zlib’ association exists only because cow_spdy used Erlang’s zlib NIF for SPDY header decompression. Document Filters does not use Erlang/OTP, cowlib, cowboy, or any SPDY protocol implementation, and does not perform unbounded decompression of attacker-controlled streams. |
| 22.2 | zlib (1.2.12) | False Positive | Code Not Present | CVE-2026-43970 is a vulnerability in cowlib (ninenines/cowlib), an Erlang HTTP support library, not in the zlib C library. The flaw is in cow_spdy.erl, which calls Erlang’s zlib:inflate/2 against attacker-controlled SPDY-compressed headers without any output-size limit. The upstream fix (commit 16aad3fb9f81f5cda4d1706ff0c54237c619c282) deletes the entire cow_spdy module and contains no C code changes. The ‘zlib’ association exists only because cow_spdy used Erlang’s zlib NIF for SPDY header decompression. Document Filters does not use Erlang/OTP, cowlib, cowboy, or any SPDY protocol implementation, and does not perform unbounded decompression of attacker-controlled streams. |
| 22.1 | zlib (1.2.11) | False Positive | Code Not Present | CVE-2026-43970 is a vulnerability in cowlib (ninenines/cowlib), an Erlang HTTP support library, not in the zlib C library. The flaw is in cow_spdy.erl, which calls Erlang’s zlib:inflate/2 against attacker-controlled SPDY-compressed headers without any output-size limit. The upstream fix (commit 16aad3fb9f81f5cda4d1706ff0c54237c619c282) deletes the entire cow_spdy module and contains no C code changes. The ‘zlib’ association exists only because cow_spdy used Erlang’s zlib NIF for SPDY header decompression. Document Filters does not use Erlang/OTP, cowlib, cowboy, or any SPDY protocol implementation, and does not perform unbounded decompression of attacker-controlled streams. |
| 21.11 | zlib (1.2.11) | False Positive | Code Not Present | CVE-2026-43970 is a vulnerability in cowlib (ninenines/cowlib), an Erlang HTTP support library, not in the zlib C library. The flaw is in cow_spdy.erl, which calls Erlang’s zlib:inflate/2 against attacker-controlled SPDY-compressed headers without any output-size limit. The upstream fix (commit 16aad3fb9f81f5cda4d1706ff0c54237c619c282) deletes the entire cow_spdy module and contains no C code changes. The ‘zlib’ association exists only because cow_spdy used Erlang’s zlib NIF for SPDY header decompression. Document Filters does not use Erlang/OTP, cowlib, cowboy, or any SPDY protocol implementation, and does not perform unbounded decompression of attacker-controlled streams. |
| 21.8 | zlib (1.2.11) | False Positive | Code Not Present | CVE-2026-43970 is a vulnerability in cowlib (ninenines/cowlib), an Erlang HTTP support library, not in the zlib C library. The flaw is in cow_spdy.erl, which calls Erlang’s zlib:inflate/2 against attacker-controlled SPDY-compressed headers without any output-size limit. The upstream fix (commit 16aad3fb9f81f5cda4d1706ff0c54237c619c282) deletes the entire cow_spdy module and contains no C code changes. The ‘zlib’ association exists only because cow_spdy used Erlang’s zlib NIF for SPDY header decompression. Document Filters does not use Erlang/OTP, cowlib, cowboy, or any SPDY protocol implementation, and does not perform unbounded decompression of attacker-controlled streams. |
| 21.5.0 | zlib (1.2.11) | False Positive | Code Not Present | CVE-2026-43970 is a vulnerability in cowlib (ninenines/cowlib), an Erlang HTTP support library, not in the zlib C library. The flaw is in cow_spdy.erl, which calls Erlang’s zlib:inflate/2 against attacker-controlled SPDY-compressed headers without any output-size limit. The upstream fix (commit 16aad3fb9f81f5cda4d1706ff0c54237c619c282) deletes the entire cow_spdy module and contains no C code changes. The ‘zlib’ association exists only because cow_spdy used Erlang’s zlib NIF for SPDY header decompression. Document Filters does not use Erlang/OTP, cowlib, cowboy, or any SPDY protocol implementation, and does not perform unbounded decompression of attacker-controlled streams. |
| 21.2.0 | zlib (1.2.11) | False Positive | Code Not Present | CVE-2026-43970 is a vulnerability in cowlib (ninenines/cowlib), an Erlang HTTP support library, not in the zlib C library. The flaw is in cow_spdy.erl, which calls Erlang’s zlib:inflate/2 against attacker-controlled SPDY-compressed headers without any output-size limit. The upstream fix (commit 16aad3fb9f81f5cda4d1706ff0c54237c619c282) deletes the entire cow_spdy module and contains no C code changes. The ‘zlib’ association exists only because cow_spdy used Erlang’s zlib NIF for SPDY header decompression. Document Filters does not use Erlang/OTP, cowlib, cowboy, or any SPDY protocol implementation, and does not perform unbounded decompression of attacker-controlled streams. |
| 11.4.19.3667 | zlib (1.2.11) | False Positive | Code Not Present | CVE-2026-43970 is a vulnerability in cowlib (ninenines/cowlib), an Erlang HTTP support library, not in the zlib C library. The flaw is in cow_spdy.erl, which calls Erlang’s zlib:inflate/2 against attacker-controlled SPDY-compressed headers without any output-size limit. The upstream fix (commit 16aad3fb9f81f5cda4d1706ff0c54237c619c282) deletes the entire cow_spdy module and contains no C code changes. The ‘zlib’ association exists only because cow_spdy used Erlang’s zlib NIF for SPDY header decompression. Document Filters does not use Erlang/OTP, cowlib, cowboy, or any SPDY protocol implementation, and does not perform unbounded decompression of attacker-controlled streams. |
| 11.4.18.3599 | zlib (1.2.11) | False Positive | Code Not Present | CVE-2026-43970 is a vulnerability in cowlib (ninenines/cowlib), an Erlang HTTP support library, not in the zlib C library. The flaw is in cow_spdy.erl, which calls Erlang’s zlib:inflate/2 against attacker-controlled SPDY-compressed headers without any output-size limit. The upstream fix (commit 16aad3fb9f81f5cda4d1706ff0c54237c619c282) deletes the entire cow_spdy module and contains no C code changes. The ‘zlib’ association exists only because cow_spdy used Erlang’s zlib NIF for SPDY header decompression. Document Filters does not use Erlang/OTP, cowlib, cowboy, or any SPDY protocol implementation, and does not perform unbounded decompression of attacker-controlled streams. |
| 11.4.16.3445 | zlib (1.2.11) | False Positive | Code Not Present | CVE-2026-43970 is a vulnerability in cowlib (ninenines/cowlib), an Erlang HTTP support library, not in the zlib C library. The flaw is in cow_spdy.erl, which calls Erlang’s zlib:inflate/2 against attacker-controlled SPDY-compressed headers without any output-size limit. The upstream fix (commit 16aad3fb9f81f5cda4d1706ff0c54237c619c282) deletes the entire cow_spdy module and contains no C code changes. The ‘zlib’ association exists only because cow_spdy used Erlang’s zlib NIF for SPDY header decompression. Document Filters does not use Erlang/OTP, cowlib, cowboy, or any SPDY protocol implementation, and does not perform unbounded decompression of attacker-controlled streams. |
| 11.4.15.3368 | zlib (1.2.11) | False Positive | Code Not Present | CVE-2026-43970 is a vulnerability in cowlib (ninenines/cowlib), an Erlang HTTP support library, not in the zlib C library. The flaw is in cow_spdy.erl, which calls Erlang’s zlib:inflate/2 against attacker-controlled SPDY-compressed headers without any output-size limit. The upstream fix (commit 16aad3fb9f81f5cda4d1706ff0c54237c619c282) deletes the entire cow_spdy module and contains no C code changes. The ‘zlib’ association exists only because cow_spdy used Erlang’s zlib NIF for SPDY header decompression. Document Filters does not use Erlang/OTP, cowlib, cowboy, or any SPDY protocol implementation, and does not perform unbounded decompression of attacker-controlled streams. |
| 11.4.14.3263 | zlib (1.2.11) | False Positive | Code Not Present | CVE-2026-43970 is a vulnerability in cowlib (ninenines/cowlib), an Erlang HTTP support library, not in the zlib C library. The flaw is in cow_spdy.erl, which calls Erlang’s zlib:inflate/2 against attacker-controlled SPDY-compressed headers without any output-size limit. The upstream fix (commit 16aad3fb9f81f5cda4d1706ff0c54237c619c282) deletes the entire cow_spdy module and contains no C code changes. The ‘zlib’ association exists only because cow_spdy used Erlang’s zlib NIF for SPDY header decompression. Document Filters does not use Erlang/OTP, cowlib, cowboy, or any SPDY protocol implementation, and does not perform unbounded decompression of attacker-controlled streams. |
| 11.4.13.3179 | zlib (1.2.11) | False Positive | Code Not Present | CVE-2026-43970 is a vulnerability in cowlib (ninenines/cowlib), an Erlang HTTP support library, not in the zlib C library. The flaw is in cow_spdy.erl, which calls Erlang’s zlib:inflate/2 against attacker-controlled SPDY-compressed headers without any output-size limit. The upstream fix (commit 16aad3fb9f81f5cda4d1706ff0c54237c619c282) deletes the entire cow_spdy module and contains no C code changes. The ‘zlib’ association exists only because cow_spdy used Erlang’s zlib NIF for SPDY header decompression. Document Filters does not use Erlang/OTP, cowlib, cowboy, or any SPDY protocol implementation, and does not perform unbounded decompression of attacker-controlled streams. |
| 11.4.12.3054 | zlib (1.2.11) | False Positive | Code Not Present | CVE-2026-43970 is a vulnerability in cowlib (ninenines/cowlib), an Erlang HTTP support library, not in the zlib C library. The flaw is in cow_spdy.erl, which calls Erlang’s zlib:inflate/2 against attacker-controlled SPDY-compressed headers without any output-size limit. The upstream fix (commit 16aad3fb9f81f5cda4d1706ff0c54237c619c282) deletes the entire cow_spdy module and contains no C code changes. The ‘zlib’ association exists only because cow_spdy used Erlang’s zlib NIF for SPDY header decompression. Document Filters does not use Erlang/OTP, cowlib, cowboy, or any SPDY protocol implementation, and does not perform unbounded decompression of attacker-controlled streams. |
| 11.4.11.3040 | zlib (1.2.11) | False Positive | Code Not Present | CVE-2026-43970 is a vulnerability in cowlib (ninenines/cowlib), an Erlang HTTP support library, not in the zlib C library. The flaw is in cow_spdy.erl, which calls Erlang’s zlib:inflate/2 against attacker-controlled SPDY-compressed headers without any output-size limit. The upstream fix (commit 16aad3fb9f81f5cda4d1706ff0c54237c619c282) deletes the entire cow_spdy module and contains no C code changes. The ‘zlib’ association exists only because cow_spdy used Erlang’s zlib NIF for SPDY header decompression. Document Filters does not use Erlang/OTP, cowlib, cowboy, or any SPDY protocol implementation, and does not perform unbounded decompression of attacker-controlled streams. |
| 11.4.11.2990 | zlib (1.2.11) | False Positive | Code Not Present | CVE-2026-43970 is a vulnerability in cowlib (ninenines/cowlib), an Erlang HTTP support library, not in the zlib C library. The flaw is in cow_spdy.erl, which calls Erlang’s zlib:inflate/2 against attacker-controlled SPDY-compressed headers without any output-size limit. The upstream fix (commit 16aad3fb9f81f5cda4d1706ff0c54237c619c282) deletes the entire cow_spdy module and contains no C code changes. The ‘zlib’ association exists only because cow_spdy used Erlang’s zlib NIF for SPDY header decompression. Document Filters does not use Erlang/OTP, cowlib, cowboy, or any SPDY protocol implementation, and does not perform unbounded decompression of attacker-controlled streams. |
| 11.4.10.2934 | zlib (1.2.11) | False Positive | Code Not Present | CVE-2026-43970 is a vulnerability in cowlib (ninenines/cowlib), an Erlang HTTP support library, not in the zlib C library. The flaw is in cow_spdy.erl, which calls Erlang’s zlib:inflate/2 against attacker-controlled SPDY-compressed headers without any output-size limit. The upstream fix (commit 16aad3fb9f81f5cda4d1706ff0c54237c619c282) deletes the entire cow_spdy module and contains no C code changes. The ‘zlib’ association exists only because cow_spdy used Erlang’s zlib NIF for SPDY header decompression. Document Filters does not use Erlang/OTP, cowlib, cowboy, or any SPDY protocol implementation, and does not perform unbounded decompression of attacker-controlled streams. |
| 11.4.9.2878 | zlib (1.2.11) | False Positive | Code Not Present | CVE-2026-43970 is a vulnerability in cowlib (ninenines/cowlib), an Erlang HTTP support library, not in the zlib C library. The flaw is in cow_spdy.erl, which calls Erlang’s zlib:inflate/2 against attacker-controlled SPDY-compressed headers without any output-size limit. The upstream fix (commit 16aad3fb9f81f5cda4d1706ff0c54237c619c282) deletes the entire cow_spdy module and contains no C code changes. The ‘zlib’ association exists only because cow_spdy used Erlang’s zlib NIF for SPDY header decompression. Document Filters does not use Erlang/OTP, cowlib, cowboy, or any SPDY protocol implementation, and does not perform unbounded decompression of attacker-controlled streams. |
| 11.4.8.2822 | zlib (1.2.11) | False Positive | Code Not Present | CVE-2026-43970 is a vulnerability in cowlib (ninenines/cowlib), an Erlang HTTP support library, not in the zlib C library. The flaw is in cow_spdy.erl, which calls Erlang’s zlib:inflate/2 against attacker-controlled SPDY-compressed headers without any output-size limit. The upstream fix (commit 16aad3fb9f81f5cda4d1706ff0c54237c619c282) deletes the entire cow_spdy module and contains no C code changes. The ‘zlib’ association exists only because cow_spdy used Erlang’s zlib NIF for SPDY header decompression. Document Filters does not use Erlang/OTP, cowlib, cowboy, or any SPDY protocol implementation, and does not perform unbounded decompression of attacker-controlled streams. |