A resource exhaustion vulnerability in the ninenines cowlib library allows unauthenticated remote attackers to trigger a denial of service on systems using the affected HTTP/2 or HTTP/3 implementations.

The library fails to properly throttle or limit the allocation of resources during HTTP/2 or HTTP/3 protocol processing. This allows an unauthenticated remote peer to send specifically crafted traffic that consumes excessive memory, resulting in a denial of service condition.

This vulnerability presents a significant risk to the availability of services relying on cowlib. With a CVSS score of 8.7, a successful denial of service attack can disrupt critical business applications, leading to potential revenue loss and service outages for end users.

Immediate Action: Upgrade the cowlib dependency to version 2.19.0 or the latest stable release.

Proactive Monitoring: Monitor server memory utilization and HTTP/2 or HTTP/3 traffic patterns for sudden, unexplained spikes that could indicate an exploitation attempt.

Compensating Controls: Utilize a Web Application Firewall or load balancer capable of inspecting HTTP/2 and HTTP/3 traffic to drop malformed or excessive requests before they reach the backend application.

Public Exploit Available: Unknown.

Denial of service vulnerabilities in core networking libraries can have widespread impacts. Organizations should immediately audit their software dependencies to identify and update any applications utilizing the vulnerable cowlib library versions.