CVE-2026-59248: Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS
CVE-2026-59248 is a vulnerability in Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS, rated Moderate by Microsoft. Microsoft has not reported exploitation in the wild. The EPSS model estimates a 0.29% probability of exploitation activity in the next 30 days, higher than 22% of all scored vulnerabilities. Microsoft released the fix on 6 August 2026, outside Patch Tuesday. It affects 2 products in 1 product family (Open Source Software).
Key facts
- CVE ID
- CVE-2026-59248
- Severity
- N/A
- Microsoft severity
- Moderate
- Exploited in the wild
- No
- Publicly disclosed
- No
- Weakness
- CWE-770
- EPSS
- 0.29% (percentile 22%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- July 2026 Patch Tuesday
- Product families
- Open Source Software
Affected products (2)
Open Source Software
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| azl3 rabbitmq-server 3.13.7-9 on Azure Linux 3.0 | Security update | Security Update | 3.13.7-9 | |
| azl3 rabbitmq-server 3.13.7-8 on Azure Linux 3.0 |
Exploitation and detection
Detection and weaponization
Weaponization maturity: Exploit.
Proof-of-concept repositories (1)
NIST NVD data
- NVD status
- Deferred
- NVD CVSS
- 8.7 (HIGH)
- NVD weakness
- CWE-770
- Published to NVD
- NVD last modified
References
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. | |
| 2.0 | Information published. | |
| 3.0 | Information published. |