This vulnerability in cowlib affects the SPDY header compression handling where the function cow_spdy:inflate/2 decompresses peer-supplied compressed data using zlib:inflate/2 without limiting the decompressed output size. Since the SPDY header compression dictionary is public and zlib can achieve compression ratios around 1024:1 on repeated bytes, a small compressed payload can expand to gigabytes in memory. This causes memory exhaustion on the BEAM virtual machine heap, resulting in denial of service by crashing the node. The affected parsers include syn_stream, syn_reply, and headers frame types via cow_spdy:parse_headers/2. The issue impacts cowlib versions from 0.1.0 up to but not including 2.16.1.

An unauthenticated remote attacker can send a single specially crafted SPDY frame to a vulnerable cowlib instance, triggering excessive memory allocation due to decompression of highly compressed data. This leads to out-of-memory conditions and crashes the node, causing denial of service. There is no indication of data confidentiality or integrity impact. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, consider implementing network-level protections to detect and block suspicious SPDY frames or limit resource usage for decompression operations if possible.