CVE-2026-43970

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43970", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-05-04T18:23:25.574Z", "datePublished": "2026-05-13T18:43:11.640Z", "dateUpdated": "2026-05-15T04:33:30.898Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["cow_spdy"], "packageName": "cowlib", "packageURL": "pkg:hex/cowlib", "product": "cowlib", "programFiles": ["src/cow_spdy.erl"], "programRoutines": [{"name": "cow_spdy:parse/2"}, {"name": "cow_spdy:inflate/2"}, {"name": "cow_spdy:parse_headers/2"}, {"name": "cow_spdy:parse_headers/4"}], "repo": "https://github.com/ninenines/cowlib", "vendor": "ninenines", "versions": [{"lessThan": "2.16.1", "status": "affected", "version": "0.1.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["cow_spdy"], "packageName": "ninenines/cowlib", "packageURL": "pkg:github/ninenines/cowlib", "product": "cowlib", "programFiles": ["src/cow_spdy.erl"], "programRoutines": [{"name": "cow_spdy:parse/2"}, {"name": "cow_spdy:inflate/2"}, {"name": "cow_spdy:parse_headers/2"}, {"name": "cow_spdy:parse_headers/4"}], "repo": "https://github.com/ninenines/cowlib", "vendor": "ninenines", "versions": [{"lessThan": "16aad3fb9f81f5cda4d1706ff0c54237c619c282", "status": "affected", "version": "fad5c0049df278cc498b6cdb519b09e845a070a8", "versionType": "git"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The application must use <tt>cow_spdy:parse/2</tt> to parse SPDY frames from an untrusted peer. cowboy itself does not use <tt>cow_spdy</tt>; only direct callers of the <tt>cow_spdy</tt> API are affected.</p>"}], "value": "The application must use cow_spdy:parse/2 to parse SPDY frames from an untrusted peer. cowboy itself does not use cow_spdy; only direct callers of the cow_spdy API are affected."}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.16.1", "versionStartIncluding": "0.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Peter Ullrich"}, {"lang": "en", "type": "remediation developer", "value": "Lo\u00efc Hoguin"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenines cowlib allows unauthenticated remote denial of service via memory exhaustion.</p><p><tt>cow_spdy:inflate/2</tt> in cowlib passes peer-supplied compressed bytes directly to <tt>zlib:inflate/2</tt> with no output size bound. The SPDY header compression dictionary (<tt>?ZDICT</tt>) is public, and zlib compresses long runs of repeated bytes at roughly 1024:1, so a few kilobytes of SPDY frame payload can decompress to gigabytes on the BEAM heap, OOM-killing the node. A single unauthenticated SPDY frame is sufficient to trigger the condition. The parsers for <tt>syn_stream</tt>, <tt>syn_reply</tt>, and <tt>headers</tt> frame types are all affected via <tt>cow_spdy:parse_headers/2</tt>.</p><p>This issue affects cowlib from 0.1.0 before 2.16.1.</p>"}], "value": "Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenines cowlib allows unauthenticated remote denial of service via memory exhaustion.\n\ncow_spdy:inflate/2 in cowlib passes peer-supplied compressed bytes directly to zlib:inflate/2 with no output size bound. The SPDY header compression dictionary (?ZDICT) is public, and zlib compresses long runs of repeated bytes at roughly 1024:1, so a few kilobytes of SPDY frame payload can decompress to gigabytes on the BEAM heap, OOM-killing the node. A single unauthenticated SPDY frame is sufficient to trigger the condition. The parsers for syn_stream, syn_reply, and headers frame types are all affected via cow_spdy:parse_headers/2.\n\nThis issue affects cowlib from 0.1.0 before 2.16.1."}], "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130 Excessive Allocation"}]}], "metrics": [{"cvssV4_0": {"attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 8.2, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-409", "description": "CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-05-15T04:33:30.898Z"}, "references": [{"tags": ["related", "third-party-advisory"], "url": "https://cna.erlef.org/cves/CVE-2026-43970.html"}, {"tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-43970"}, {"tags": ["patch"], "url": "https://github.com/ninenines/cowlib/commit/16aad3fb9f81f5cda4d1706ff0c54237c619c282"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Upgrade to cowlib 2.16.1 or later, in which the <tt>cow_spdy</tt> module has been removed entirely. No patched version of <tt>cow_spdy</tt> will be provided. Migrate away from SPDY, which has been deprecated since 2015 in favour of HTTP/2.</p>"}], "value": "Upgrade to cowlib 2.16.1 or later, in which the cow_spdy module has been removed entirely. No patched version of cow_spdy will be provided. Migrate away from SPDY, which has been deprecated since 2015 in favour of HTTP/2."}], "source": {"discovery": "EXTERNAL"}, "title": "Decompression Bomb in cow_spdy:inflate/2 Allows Memory Exhaustion via Crafted SPDY Frame", "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-14T12:38:59.086048Z", "id": "CVE-2026-43970", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-14T12:39:10.669Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43970", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-14T12:38:59.086048Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-14T12:39:04.066Z"}}], "cna": {"title": "Decompression Bomb in cow_spdy:inflate/2 Allows Memory Exhaustion via Crafted SPDY Frame", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Peter Ullrich"}, {"lang": "en", "type": "remediation developer", "value": "Lo\u00efc Hoguin"}], "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130 Excessive Allocation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"], "repo": "https://github.com/ninenines/cowlib", "vendor": "ninenines", "modules": ["cow_spdy"], "product": "cowlib", "versions": [{"status": "affected", "version": "0.1.0", "lessThan": "2.16.1", "versionType": "semver"}], "packageURL": "pkg:hex/cowlib", "packageName": "cowlib", "programFiles": ["src/cow_spdy.erl"], "collectionURL": "https://repo.hex.pm", "defaultStatus": "unaffected", "programRoutines": [{"name": "cow_spdy:parse/2"}, {"name": "cow_spdy:inflate/2"}, {"name": "cow_spdy:parse_headers/2"}, {"name": "cow_spdy:parse_headers/4"}]}, {"cpes": ["cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"], "repo": "https://github.com/ninenines/cowlib", "vendor": "ninenines", "modules": ["cow_spdy"], "product": "cowlib", "versions": [{"status": "affected", "version": "fad5c0049df278cc498b6cdb519b09e845a070a8", "lessThan": "16aad3fb9f81f5cda4d1706ff0c54237c619c282", "versionType": "git"}], "packageURL": "pkg:github/ninenines/cowlib", "packageName": "ninenines/cowlib", "programFiles": ["src/cow_spdy.erl"], "collectionURL": "https://github.com", "defaultStatus": "unaffected", "programRoutines": [{"name": "cow_spdy:parse/2"}, {"name": "cow_spdy:inflate/2"}, {"name": "cow_spdy:parse_headers/2"}, {"name": "cow_spdy:parse_headers/4"}]}], "solutions": [{"lang": "en", "value": "Upgrade to cowlib 2.16.1 or later, in which the cow_spdy module has been removed entirely. No patched version of cow_spdy will be provided. Migrate away from SPDY, which has been deprecated since 2015 in favour of HTTP/2.", "supportingMedia": [{"type": "text/html", "value": "<p>Upgrade to cowlib 2.16.1 or later, in which the <tt>cow_spdy</tt> module has been removed entirely. No patched version of <tt>cow_spdy</tt> will be provided. Migrate away from SPDY, which has been deprecated since 2015 in favour of HTTP/2.</p>", "base64": false}]}], "references": [{"url": "https://cna.erlef.org/cves/CVE-2026-43970.html", "tags": ["related", "third-party-advisory"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-43970", "tags": ["related"]}, {"url": "https://github.com/ninenines/cowlib/commit/16aad3fb9f81f5cda4d1706ff0c54237c619c282", "tags": ["patch"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenines cowlib allows unauthenticated remote denial of service via memory exhaustion.\n\ncow_spdy:inflate/2 in cowlib passes peer-supplied compressed bytes directly to zlib:inflate/2 with no output size bound. The SPDY header compression dictionary (?ZDICT) is public, and zlib compresses long runs of repeated bytes at roughly 1024:1, so a few kilobytes of SPDY frame payload can decompress to gigabytes on the BEAM heap, OOM-killing the node. A single unauthenticated SPDY frame is sufficient to trigger the condition. The parsers for syn_stream, syn_reply, and headers frame types are all affected via cow_spdy:parse_headers/2.\n\nThis issue affects cowlib from 0.1.0 before 2.16.1.", "supportingMedia": [{"type": "text/html", "value": "<p>Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenines cowlib allows unauthenticated remote denial of service via memory exhaustion.</p><p><tt>cow_spdy:inflate/2</tt> in cowlib passes peer-supplied compressed bytes directly to <tt>zlib:inflate/2</tt> with no output size bound. The SPDY header compression dictionary (<tt>?ZDICT</tt>) is public, and zlib compresses long runs of repeated bytes at roughly 1024:1, so a few kilobytes of SPDY frame payload can decompress to gigabytes on the BEAM heap, OOM-killing the node. A single unauthenticated SPDY frame is sufficient to trigger the condition. The parsers for <tt>syn_stream</tt>, <tt>syn_reply</tt>, and <tt>headers</tt> frame types are all affected via <tt>cow_spdy:parse_headers/2</tt>.</p><p>This issue affects cowlib from 0.1.0 before 2.16.1.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-409", "description": "CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)"}]}], "configurations": [{"lang": "en", "value": "The application must use cow_spdy:parse/2 to parse SPDY frames from an untrusted peer. cowboy itself does not use cow_spdy; only direct callers of the cow_spdy API are affected.", "supportingMedia": [{"type": "text/html", "value": "<p>The application must use <tt>cow_spdy:parse/2</tt> to parse SPDY frames from an untrusted peer. cowboy itself does not use <tt>cow_spdy</tt>; only direct callers of the <tt>cow_spdy</tt> API are affected.</p>", "base64": false}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.16.1", "versionStartIncluding": "0.1.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-05-15T04:33:30.898Z"}}}, "cveMetadata": {"cveId": "CVE-2026-43970", "state": "PUBLISHED", "dateUpdated": "2026-05-15T04:33:30.898Z", "dateReserved": "2026-05-04T18:23:25.574Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-05-13T18:43:11.640Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["cow_spdy"], "packageName": "cowlib", "packageURL": "pkg:hex/cowlib", "product": "cowlib", "programFiles": ["src/cow_spdy.erl"], "programRoutines": [{"name": "cow_spdy:parse/2"}, {"name": "cow_spdy:inflate/2"}, {"name": "cow_spdy:parse_headers/2"}, {"name": "cow_spdy:parse_headers/4"}], "repo": "https://github.com/ninenines/cowlib", "vendor": "ninenines", "versions": [{"lessThan": "2.16.1", "status": "affected", "version": "0.1.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["cow_spdy"], "packageName": "ninenines/cowlib", "packageURL": "pkg:github/ninenines/cowlib", "product": "cowlib", "programFiles": ["src/cow_spdy.erl"], "programRoutines": [{"name": "cow_spdy:parse/2"}, {"name": "cow_spdy:inflate/2"}, {"name": "cow_spdy:parse_headers/2"}, {"name": "cow_spdy:parse_headers/4"}], "repo": "https://github.com/ninenines/cowlib", "vendor": "ninenines", "versions": [{"lessThan": "16aad3fb9f81f5cda4d1706ff0c54237c619c282", "status": "affected", "version": "fad5c0049df278cc498b6cdb519b09e845a070a8", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenines cowlib allows unauthenticated remote denial of service via memory exhaustion.\n\ncow_spdy:inflate/2 in cowlib passes peer-supplied compressed bytes directly to zlib:inflate/2 with no output size bound. The SPDY header compression dictionary (?ZDICT) is public, and zlib compresses long runs of repeated bytes at roughly 1024:1, so a few kilobytes of SPDY frame payload can decompress to gigabytes on the BEAM heap, OOM-killing the node. A single unauthenticated SPDY frame is sufficient to trigger the condition. The parsers for syn_stream, syn_reply, and headers frame types are all affected via cow_spdy:parse_headers/2.\n\nThis issue affects cowlib from 0.1.0 before 2.16.1."}, {"lang": "es", "value": "La vulnerabilidad de Manejo Inadecuado de Datos Altamente Comprimidos (Amplificaci\u00f3n de Datos) en ninenines cowlib permite una denegaci\u00f3n de servicio remota no autenticada a trav\u00e9s del agotamiento de la memoria.\n\ncow_spdy:inflate/2 en cowlib pasa los bytes comprimidos suministrados por el par directamente a zlib:inflate/2 sin un l\u00edmite de tama\u00f1o de salida. El diccionario de compresi\u00f3n de cabeceras SPDY (?ZDICT) es p\u00fablico, y zlib comprime largas secuencias de bytes repetidos a una proporci\u00f3n aproximada de 1024:1, por lo que unos pocos kilobytes de carga \u00fatil de trama SPDY pueden descomprimirse a gigabytes en el heap de BEAM, provocando la terminaci\u00f3n del nodo por falta de memoria. Una \u00fanica trama SPDY no autenticada es suficiente para activar la condici\u00f3n. Los analizadores para los tipos de trama syn_stream, syn_reply y headers est\u00e1n todos afectados a trav\u00e9s de cow_spdy:parse_headers/2.\n\nEste problema afecta a cowlib desde la versi\u00f3n 0.1.0 anterior a la 2.16.1."}], "id": "CVE-2026-43970", "lastModified": "2026-10-26T17:10:03.270", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43970", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-14T12:38:59.086048Z", "version": "2.0.3"}}]}, "published": "2026-05-13T19:17:25.440", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://cna.erlef.org/cves/CVE-2026-43970.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/ninenines/cowlib/commit/16aad3fb9f81f5cda4d1706ff0c54237c619c282"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://osv.dev/vulnerability/EEF-CVE-2026-43970"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-409"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.1.0,2.16.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fad5c0049df278cc498b6cdb519b09e845a070a8,16aad3fb9f81f5cda4d1706ff0c54237c619c282)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "cowlib", "vendor": "ninenines"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.1.0,2.16.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "cowlib", "source": "cna", "vendor": "ninenines"}, "product": "cowlib", "vendor": "ninenines"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fad5c0049df278cc498b6cdb519b09e845a070a8,16aad3fb9f81f5cda4d1706ff0c54237c619c282)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "cowlib", "source": "cna", "vendor": "ninenines"}, "product": "cowlib", "vendor": "ninenines"}], "created": "2026-05-13T20:30:04.259278+00:00", "updated": "2026-05-13T20:45:03.821075+00:00", "vendors": ["ninenines", "ninenines$PRODUCT$cowlib"]}