The vulnerability in ninenines cowlib's cow_http_te module arises from its chunked transfer-encoding parser accepting an unbounded length of hex digits in the chunk-size field. Each hex digit triggers a bignum multiplication, resulting in O(N²) CPU complexity and O(N) memory usage for N digits. When the input is drip-fed, the parser restarts length calculation on each partial read, increasing CPU complexity to O(N³). This flaw allows an unauthenticated remote attacker to send an HTTP/1.1 request with Transfer-Encoding: chunked and an excessively long chunk-size hex string to cause denial of service by exhausting CPU and memory resources. The affected versions include cowlib from 0.6.0 up to but not including 2.16.1. The vulnerability is tracked as CWE-400 (Uncontrolled Resource Consumption). No patch or official remediation level is currently documented.

Successful exploitation results in denial of service due to excessive CPU consumption and memory amplification on the affected server running vulnerable cowlib versions. The attack requires no authentication and can be triggered remotely via crafted HTTP requests, potentially disrupting service availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing network-level protections such as rate limiting or filtering suspicious HTTP chunked requests to mitigate potential exploitation. Monitor for unusual CPU and memory usage patterns indicative of this attack vector.