CVE-2026-59248 is a denial of service vulnerability in cowlib, an HTTP parser library used by RabbitMQ and other components. An unauthenticated remote attacker can send specially crafted HTTP/2 or HTTP/3 frames containing oversized HPACK or QPACK prefixed integers. This triggers an unbounded decoding process that causes excessive memory allocation and garbage collection, resulting in memory exhaustion and denial of service on the affected server or client. The vulnerability affects Red Hat Hardened Images RPMs, specifically rabbitmq-server4.2 versions prior to 4.2.9-0.2.hum1. Red Hat has issued an advisory (RHSA-2026:47236) describing the issue and providing updated RPMs. However, no official fix meeting Red Hat's criteria for widespread deployment and stability is currently available. The vulnerability is tracked alongside CVE-2026-65624 in the same advisory.

The vulnerability allows an unauthenticated remote attacker to cause a denial of service by exhausting memory resources on the affected system. This can lead to service outages of RabbitMQ servers or clients using the vulnerable cowlib HTTP parser. The attack vector is network-based and requires no privileges or user interaction. The impact is limited to availability degradation due to resource exhaustion.

Currently, Red Hat states that no mitigation is available or that existing options do not meet their criteria for ease of use, deployment, applicability, or stability. Users should apply the updated RPM packages (rabbitmq-server4.2-4.2.9-0.2.hum1) once they are available and verified in their environment. Monitoring Red Hat advisories for future patches or mitigations is recommended. No other specific mitigations are provided by Red Hat at this time.