CVE-2026-59248 is a denial of service vulnerability in cowlib, an HTTP parser library used by RabbitMQ components included in Red Hat Hardened Images. The flaw allows an unauthenticated remote attacker to send specially crafted HTTP/2 or HTTP/3 frames containing oversized HPACK or QPACK prefixed integers. This triggers an unbounded decoding process that causes excessive memory allocation and garbage collection, leading to memory exhaustion and service outage. The vulnerability is tracked under CWE-770 (Allocation of Resources Without Limits or Throttling). Red Hat has released an advisory (RHSA-2026:47231) describing the issue and affected RPM versions (rabbitmq-server4.3-4.3.4-0.2.hum1 for aarch64 and x86_64). Currently, no patch or mitigation meeting Red Hat's standards is available.

The vulnerability allows unauthenticated remote attackers to cause a denial of service by exhausting memory resources on affected systems running vulnerable versions of rabbitmq-server4.3. This can result in service outages due to excessive memory consumption and garbage collection triggered by malformed HTTP/2 or HTTP/3 frames. There is no impact on confidentiality or integrity reported. The attack vector is network-based and requires no privileges or user interaction.

Red Hat currently states that no mitigation is available or that existing options do not meet their criteria for ease of use, applicability, or stability. Users should monitor Red Hat advisories for future updates or fixes. Applying the provided security update when available is recommended. Until a fix is released, consider limiting exposure of affected services to untrusted networks if possible.