CVE-2026-7790: cowlib cow_http_te module Remote Code Execution Vulnerability

HIGH
Advisory Identifier: GHSA-32p9-57cr-4x65
Share
CWE-400
Published
Advisory Summary

CVE-2026-7790 is a HIGH remote code execution vulnerability (CWE-400: Uncontrolled Resource Consumption) affecting cowlib cow_http_te module libraries in the Hex ecosystem. The issue involves uncontrolled resource consumption vulnerability allows excessive allocation. Remediation is available by upgrading affected packages to version 2.16.1.

CVE-2026-7790 at a Glance

CVE Identifier CVE-2026-7790
GHSA Identifier GHSA-32p9-57cr-4x65
Severity HIGH
CVSS v3.1 Base Score N/A
CWE Classification CWE-400: Uncontrolled Resource Consumption
Affected Product cowlib cow_http_te module
Package Ecosystem Hex
Published Date
Last Updated

How to Fix CVE-2026-7790

To remediate this vulnerability, upgrade all affected cowlib cow_http_te module dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

cowlib fixed: 2.16.1 
Upgrade cowlib to 2.16.1
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for cowlib

How to Check if You Are Affected

To determine whether your application is affected by CVE-2026-7790, inspect your project dependencies for cowlib cow_http_te module:

inspect dependencies for cowlib

Analyze the terminal output to locate any version of cowlib cow_http_te module in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.16.1), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-400: Uncontrolled Resource Consumption, where the product does not properly control the allocation and maintenance of a limited resource. In cowlib cow_http_te module, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

Uncontrolled Resource Consumption vulnerability in ninenines cowlib (cow_http_te module) allows Excessive Allocation. The chunked transfer-encoding parser in cow_http_te accepts an unbounded number of hex digits in the chunk-size field. Each digit causes a bignum multiplication (Len * 16 + digit), so parsing N hex digits requires O(N²) CPU work and O(N) memory. Additionally, when input is drip-fed, the parser discards the accumulated length on each partial read and restarts from zero on resumption, raising the cost to O(N³). An unauthenticated remote attacker can exploit this by sending an HTTP/1.1 request with Transfer-Encoding: chunked and a very long chunk-size hex string to cause denial of service through CPU exhaustion and memory amplification. This vulnerability is associated with program file src/cow_http_te.erl and program routines cow_http_te:stream_chunked/2, cow_http_te:chunked_len/4. This issue affects cowlib: from 0.6.0 before 2.16.1.

CVE-2026-7790 Affected cowlib cow_http_te module Versions

1 component(s)
Fixed Versions:
2.16.1
Product / Package Ecosystem Affected Versions Fixed Version
cowlib
 Hex
≥ 0.6.0
< 2.16.1
2.16.1

References

NVD — CVE-2026-7790 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-7790
Security Fix Commit FIX COMMIT
https://github.com/ninenines/cowlib/commit/a4b8039ce8c93ab00867ef6b7e888822c09f4369
cna.erlef.org/cves/cve-2026-7790.... WEB
https://cna.erlef.org/cves/CVE-2026-7790.html
cowlib cow_http_te module Source Repository REPOSITORY
https://github.com/ninenines/cowlib
cowlib cow_http_te module Release RELEASE
https://github.com/ninenines/cowlib/releases/tag/2.16.1
osv.dev/vulnerability/eef-c... WEB
https://osv.dev/vulnerability/EEF-CVE-2026-7790

Frequently Asked Questions

What is CVE-2026-7790?
CVE-2026-7790 is a security vulnerability in cowlib cow_http_te module involving Uncontrolled Resource Consumption vulnerability allows Excessive Allocation under CWE-400: Uncontrolled Resource Consumption.
Which cowlib cow_http_te module versions are affected?
Affected versions include releases prior to 2.16.1 across affected packages: cowlib.
What version fixes CVE-2026-7790?
Upgrading to 2.16.1 (or the latest patched release for your respective branch) resolves the vulnerability.
Is cowlib affected?
Yes, cowlib is affected in releases prior to 2.16.1. Upgrade your dependency to 2.16.1 or later.
What CWE is associated with CVE-2026-7790?
CVE-2026-7790 is classified under CWE-400: Uncontrolled Resource Consumption (The product does not properly control the allocation and maintenance of a limited resource.).
How can I check Hex dependencies for CVE-2026-7790?
Run the dependency tree command: 'inspect dependencies for cowlib'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-32p9-57cr-4x65",
  "modified" : "2026-05-18T16:49:21Z",
  "published" : "2026-05-11T21:31:35Z",
  "aliases" : [ "CVE-2026-7790" ],
  "summary" : " cowlib cow_http_te module: Uncontrolled Resource Consumption vulnerability allows Excessive Allocation",
  "details" : "Uncontrolled Resource Consumption vulnerability in ninenines cowlib (cow_http_te module) allows Excessive Allocation.\n\nThe chunked transfer-encoding parser in cow_http_te accepts an unbounded number of hex digits in the chunk-size field. Each digit causes a bignum multiplication (Len * 16 + digit), so parsing N hex digits requires O(N²) CPU work and O(N) memory. Additionally, when input is drip-fed, the parser discards the accumulated length on each partial read and restarts from zero on resumption, raising the cost to O(N³). An unauthenticated remote attacker can exploit this by sending an HTTP/1.1 request with Transfer-Encoding: chunked and a very long chunk-size hex string to cause denial of service through CPU exhaustion and memory amplification.\n\nThis vulnerability is associated with program file src/cow_http_te.erl and program routines cow_http_te:stream_chunked/2, cow_http_te:chunked_len/4.\n\nThis issue affects cowlib: from 0.6.0 before 2.16.1.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Hex",
      "name" : "cowlib"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0.6.0"
      }, {
        "fixed" : "2.16.1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-7790"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/ninenines/cowlib/commit/a4b8039ce8c93ab00867ef6b7e888822c09f4369"
  }, {
    "type" : "WEB",
    "url" : "https://cna.erlef.org/cves/CVE-2026-7790.html"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/ninenines/cowlib"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/ninenines/cowlib/releases/tag/2.16.1"
  }, {
    "type" : "WEB",
    "url" : "https://osv.dev/vulnerability/EEF-CVE-2026-7790"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-400" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-05-18T16:49:21Z",
    "nvd_published_at" : "2026-05-11T19:16:29Z"
  }
}