Ninenines vulnerabilities
We track 9 vulnerabilities in Ninenines products across 3 products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on November 6, 2026.
Latest Ninenines vulnerabilities
- 8.2 High severity
cowboy: Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1. Once a request has been received in full and its handler is still running, cowb
- 8.7 High severity
cowlib: Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowlib allows an unauthenticated remote peer to exhaust the memory of an HTTP/2 endpoint via HPACK-indexed header fields. cow_http2_machine:headers_decode/4 in src/cow_http2_machin
- 8.7 High severity
cowlib: Allocation of Resources Without Limits or Throttling
Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of service. The HPACK and QPACK prefixed-integer decoder c
- 7.5 High severity
gun: Improper Enforcement of Behavioral Workflow
Unexpected Status Code or Return Value vulnerability in ninenines gun (gun_http module) allows a malicious HTTP server to force the client into raw protocol mode via an unsolicited 101 Switching Protocols response. In gun_http:handle_inform/8, when a 101 Switc
- 7.5 High severity
gun: Allocation of Resources Without Limits or Throttling
Uncontrolled Resource Consumption vulnerability in ninenines gun (gun_http module) allows a malicious server to exhaust client memory via unbounded HTTP/1.1 response buffering. In gun_http:handle/5, three clauses accumulate incoming TCP data into the connectio
- 7.2 High severity
gun: Origin Validation Error
Origin Validation Error vulnerability in ninenines gun (gun_http2 module) allows cross-origin cookie injection via unvalidated HTTP/2 PUSH_PROMISE authority. In gun_http2:push_promise_frame/7, the :authority pseudo-header from an incoming PUSH_PROMISE frame is
- 8.2 High severity
cowboy: Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows denial of service via unbounded buffer accumulation in multipart header parsing. cowboy_req:read_part/3 in src/cowboy_req.erl accumulates incoming request bytes into
- 8.2 High severity
cowlib: Improper Handling of Highly Compressed Data (Data Amplification)
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenines cowlib allows unauthenticated remote denial of service via memory exhaustion. cow_spdy:inflate/2 in cowlib passes peer-supplied compressed bytes directly to zlib:inflat
- 7.5 High severity
cowlib: Uncontrolled Resource Consumption
Uncontrolled Resource Consumption vulnerability in ninenines cowlib (cow_http_te module) allows Excessive Allocation. The chunked transfer-encoding parser in cow_http_te accepts an unbounded number of hex digits in the chunk-size field. Each digit causes a big