Coordinated security update of cowlib and cowboy, released together upstream on 2026-07-27.
cowlib 2.19.0 fixes CVE-2026-59248: unbounded HPACK/QPACK prefixed-integer decoding allowed a denial of service. It also rejects empty HTTP/2 CONTINUATION frames and NUL bytes in multipart headers, validates cookie domain and path, limits cow_cookie:parse_cookie to 100 cookies by default, applies Sec-Websocket-Version limits to response headers, and enforces a custom max_concurrent_streams immediately.
cowboy 2.18.0 is the matching release and requires cowlib 2.19.0. It rejects CR in HTTP/1.1 header values, rejects requests containing a fragment component, rejects HTTP/2 requests where host disagrees with :authority, adds a max_cookies option to the cowboy_req cookie functions, fixes max_headers handling with duplicate headers, and fixes the websocket max_inflate_size calculation.
Note that cowboy 2.18.0 removes concurrent processing of pipelined HTTP/1.1 requests. Applications relying on that behaviour may see different throughput characteristics.
Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:
sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-7d233ad8b0Please log in to add feedback.
This update has been submitted for testing by peter.
This update's test gating status has been changed to 'waiting'.
This update's test gating status has been changed to 'passed'.
This update has been pushed to testing.