cowlib (Hex)
Advisories
11
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 2.21.0 or later clears every advisory below that has a fix.
Upgrade commands
mix
{:cowlib, "~> 2.21.0"} # then: mix deps.update cowlibKnown vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| EEF-CVE-2026-43971 Link Header Directive Smuggling via Unescaped target/rel/Attribute Keys in cow_link:link/1 |
Not rated yet EPSS 0.52% |
>= 2.9.0, < 2.20.0 | 2.20.0 |
| EEF-CVE-2026-59248 Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS |
Not rated yet EPSS 0.29% |
>= 2.0.0-pre.1, < 2.19.0 | 2.19.0 |
| EEF-CVE-2026-43966 HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2 |
Medium EPSS 0.26% |
>= 2.9.0 | No fix yet |
| EEF-CVE-2026-43970 Decompression Bomb in cow_spdy:inflate/2 Allows Memory Exhaustion via Crafted SPDY Frame |
High EPSS 0.51% |
>= 0.1.0, < 2.16.1 | 2.16.1 |
| EEF-CVE-2026-43970 Decompression Bomb in cow_spdy:inflate/2 Allows Memory Exhaustion via Crafted SPDY Frame |
High EPSS 0.51% |
>= 0.1.0, < 2.16.1 | 2.16.1 |
| EEF-CVE-2026-43968 CR Injection in SSE Encoder Enables Event Splitting via cow_sse:event/1 |
Medium EPSS 0.27% |
>= 2.6.0, < 2.16.1 | 2.16.1 |
| EEF-CVE-2026-43968 CR Injection in SSE Encoder Enables Event Splitting via cow_sse:event/1 |
Medium EPSS 0.27% |
>= 2.6.0, < 2.16.1 | 2.16.1 |
| EEF-CVE-2026-7790 Unbounded chunk-size hex digits in cowlib cause quadratic CPU and memory DoS |
High EPSS 0.43% |
>= 0.6.0, < 2.16.1 | 2.16.1 |
| EEF-CVE-2026-7790 Unbounded chunk-size hex digits in cowlib cause quadratic CPU and memory DoS |
High EPSS 0.43% |
>= 0.6.0, < 2.16.1 | 2.16.1 |
| EEF-CVE-2026-43969 Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1 |
Low EPSS 0.15% |
>= 2.9.0, < 2.21.0 | 2.21.0 |
| EEF-CVE-2026-43969 Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1 |
Low EPSS 0.15% |
>= 2.9.0, <= 2.16.1 | No fix yet |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor