The vulnerability in ninenines cowlib's cow_http_te module arises from the chunked transfer-encoding parser accepting an unlimited number of hex digits in the chunk-size field. Each hex digit triggers a bignum multiplication operation, resulting in O(N²) CPU complexity and O(N) memory usage for N digits. When input is drip-fed, the parser restarts the length calculation on each partial read, increasing the computational cost to O(N³). This flaw allows an unauthenticated attacker to cause denial of service by sending an HTTP/1.1 request with Transfer-Encoding: chunked and an excessively long chunk-size hex string, leading to CPU exhaustion and memory amplification. The issue affects cowlib versions starting from 0.6.0 up to but not including 2.16.1. The vulnerability is tracked as CWE-400 (Uncontrolled Resource Consumption) and has a CVSS 4.0 base score of 8.7, indicating high severity. No patch or official remediation level is currently documented.

An unauthenticated remote attacker can exploit this vulnerability to cause denial of service by exhausting CPU resources and amplifying memory usage on systems running affected versions of cowlib. This can disrupt service availability due to excessive resource consumption triggered by specially crafted HTTP requests with chunked transfer encoding. There are no indications of confidentiality, integrity, or other impacts beyond denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing network-level protections such as limiting the size and rate of chunked transfer-encoding requests or using a web application firewall to detect and block suspiciously long chunk-size headers. Monitor for unusual resource usage patterns that may indicate exploitation attempts.