Vendor
Ninenines
14 known vulnerabilities in products by Ninenines, 0 of them actively exploited (CISA KEV).
Key figures
14
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-43973 | gun HTTP/1.1 response buffer has no size limit allowing server-controlled memory exhaustion | 7.5 | |
| High | CVE-2026-43974 | Ninenines Gun: Improper Enforcement of Behavioral Workflow | 7.5 | |
| High | CVE-2026-113431 | Nine Nines Cowlib: Allocation of Resources Without Limits or Throttling | — | |
| High | CVE-2026-43970 | Decompression Bomb in cow_spdy:inflate/2 Allows Memory Exhaustion via Crafted SPDY Frame | — | |
| High | CVE-2026-7790 | Unbounded chunk-size hex digits in cowlib cause quadratic CPU and memory DoS | 7.5 | |
| High | CVE-2026-115701 | Ninenines Cowboy: Allocation of Resources Without Limits or Throttling | — | |
| Medium | CVE-2026-43971 | Link Header Directive Smuggling via Unescaped target/rel/Attribute Keys in cow_link:link/1 | — | |
| High | CVE-2026-59248 | Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS | — | |
| High | CVE-2026-8466 | Unbounded buffer accumulation in multipart header parsing causes denial of service in cowboy | — | |
| Medium | CVE-2026-65624 | Cowboy HTTP/1.1 max_headers Bypass via Duplicate Header Names Enables Memory Exhaustion | — | |
| High | CVE-2026-43972 | Ninenines Gun: Origin Validation Error | 7.2 | |
| Medium | CVE-2026-43966 | HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2 | 5.3 | |
| Medium | CVE-2026-43968 | CR Injection in SSE Encoder Enables Event Splitting via cow_sse:event/1 | 4.0 | |
| Low | CVE-2026-43969 | Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1 | 3.2 |
Products
| Nine Nines Cowlib | 7 | 0 |
| Ninenines Gun | 3 | 0 |