Denial of Service Vulnerability in Fedora's erlang-cowboy and cowlib

Linuxsecurity

Denial of Service Vulnerability in Fedora's erlang-cowboy and cowlib

First seen 14 Aug 2026, 10:46 UTC • •57.9

Article Content

1 / 5

Browse articles

ThreatCluster •August 15, 2026 at 10:35 UTC

•CVE-2026-59248 affects Fedora 43 and 44 due to a denial of service vulnerability.
•The vulnerability is linked to unbounded HPACK/QPACK decoding in erlang-cowboy and cowlib.
•Users are urged to apply the security updates released on 2026-07-27 immediately.

A coordinated security update was released for Fedora 43 and 44 addressing CVE-2026-59248, a denial of service vulnerability in the erlang-cowboy and cowlib libraries. This vulnerability stems from unbounded HPACK/QPACK prefixed-integer decoding, which could lead to service disruption. The updates were released upstream on 2026-07-27, with affected versions being cowlib 2.19.0 and cowboy 2.18.0. Key fixes include rejecting empty HTTP/2 CONTINUATION frames and limiting cookie parsing. Users are advised to upgrade their systems using the dnf update program. The vulnerability was published on 2026-07-28, and both Fedora 43 and 44 are impacted. The updates are crucial for maintaining system integrity and availability.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 47d ago How this analysis works

Timeline

2026-07-27

Coordinated security update released

Fedora released updates for cowlib 2.19.0 and cowboy 2.18.0 to address CVE-2026-59248.

2026-07-28

CVE-2026-59248 published

The vulnerability was officially published, highlighting the risk of denial of service due to unbounded decoding.

2026-08-14

Advisories published for Fedora 43 and 44

Linuxsecurity published advisories detailing the denial of service vulnerability and urging updates.

More articles in this cluster (4)

Threat Graph

10 entities, 18 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

DDoS
Denial of Service
T1499 - Endpoint Denial of Service

Organization (1)

Fedora

Vulnerability (1)

CVE-2026-59248

Weakness (1)

CWE-400 - Uncontrolled Resource Consumption

Affected Platform (4)

Cowboy
Cowlib
Erlang
Linux

Relationships

CVE-2026-59248 targets Cowboy
CVE-2026-59248 targets Cowlib
CVE-2026-59248 targets Erlang
CVE-2026-59248 targets Linux
DDoS targets Cowboy
DDoS targets Cowlib
DDoS targets Erlang
DDoS targets Linux
Denial of Service targets Cowboy
Denial of Service targets Cowlib
Denial of Service targets Erlang
Denial of Service targets Linux
T1499 - Endpoint Denial of Service targets Cowboy
T1499 - Endpoint Denial of Service targets Cowlib
T1499 - Endpoint Denial of Service targets Erlang
T1499 - Endpoint Denial of Service targets Linux
CVE-2026-59248 related to Fedora
CVE-2026-59248 related to CWE-400 - Uncontrolled Resource Consumption

Following this threat?

Track Fedora and CVE-2026-59248 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Zero-Day Exploits Target F5 and Check Point Products F5 Networks released emergency hotfixes for a critical zero-day vulnerability, CVE-2026-94127, in its BIG-IP Access Policy Manager on September 22, 2026, after confirming active exploitation. This flaw allows unauthenticated remote code execution (RCE) and has a CVSS score of 9.8. Concurrently, Check Point disclosed…

Critical Citrix NetScaler Zero-Day Vulnerabilities Exploited Citrix disclosed two critical zero-day vulnerabilities, CVE-2026-88771 and CVE-2026-88772, affecting NetScaler ADC and Gateway systems, which are being actively exploited. Both vulnerabilities have a CVSS score of 9.5 and allow unauthenticated attackers to execute arbitrary commands remotely. CVE-2026-88771 arises…