The vulnerability in ninenines cowlib (versions before 2.16.1) involves improper handling of highly compressed SPDY frames. Specifically, the function cow_spdy:inflate/2 passes peer-supplied compressed bytes directly to zlib:inflate/2 without bounding the output size. Since the SPDY header compression dictionary is public and zlib can decompress data at a high amplification ratio (~1024:1), a small compressed payload can decompress into gigabytes of data on the BEAM heap. This leads to memory exhaustion and an out-of-memory kill of the node, causing a denial of service. The vulnerability affects multiple SPDY frame parsers via cow_spdy:parse_headers/2. The CVSS 4.0 score is 8.2, indicating high severity. No patch or official remediation level is currently documented.

An unauthenticated attacker can send a single specially crafted SPDY frame that decompresses into a very large amount of data, exhausting memory on the affected node and causing a denial of service via out-of-memory termination. This impacts availability of services relying on vulnerable versions of cowlib. There is no indication of confidentiality or integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing network-level protections to block or rate-limit SPDY traffic from untrusted sources. Monitor for unusual memory usage patterns related to SPDY frame processing. Do not rely on generic mitigations unless specifically recommended by the vendor.