CVE-2026-43966 (GCVE-0-2026-43966)
Vulnerability from cvelistv5
Published
2026-06-08 16:34
Modified
2026-06-09 04:38
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
Summary
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in ninenines cowlib allows HTTP response splitting via non-VCHAR bytes in structured-fields string values.
cow_http_struct_hd:escape_string/2 in cowlib only escapes \ and ", passing all other bytes through verbatim. This creates an encoder/decoder asymmetry: the matching parser accepts only printable ASCII (0x20–0x7E, excluding " and \), but the encoder emits any byte including CR and LF. An application that builds a structured HTTP header via cow_http_struct_hd:item/1 (or a higher-level wrapper such as cow_http_hd:wt_protocol/1) from attacker-controlled input can have \r\n injected into the serialized header value. Once on the wire, the injected CRLF terminates the current header and any following bytes are interpreted as a new header, enabling HTTP response splitting.
This issue affects cowlib from 2.9.0.
References
| URL | Tags | |
|---|---|---|
|
|
||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-43966",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-08T18:37:59.853576Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-08T18:38:08.160Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"cow_http_struct_hd"
],
"packageName": "cowlib",
"packageURL": "pkg:hex/cowlib",
"product": "cowlib",
"programFiles": [
"src/cow_http_struct_hd.erl"
],
"programRoutines": [
{
"name": "cow_http_struct_hd:escape_string/2"
},
{
"name": "cow_http_struct_hd:bare_item/1"
}
],
"repo": "https://github.com/ninenines/cowlib",
"vendor": "ninenines",
"versions": [
{
"status": "affected",
"version": "2.9.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"cow_http_struct_hd"
],
"packageName": "ninenines/cowlib",
"packageURL": "pkg:github/ninenines/cowlib",
"product": "cowlib",
"programFiles": [
"src/cow_http_struct_hd.erl"
],
"programRoutines": [
{
"name": "cow_http_struct_hd:escape_string/2"
},
{
"name": "cow_http_struct_hd:bare_item/1"
}
],
"repo": "https://github.com/ninenines/cowlib",
"vendor": "ninenines",
"versions": [
{
"status": "affected",
"version": "a8b793db3d6ffe91d62f81baf41b1dab4cd78fb6",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe application must pass attacker-controlled data as a string value into \u003ctt\u003ecow_http_struct_hd:item/1\u003c/tt\u003e (or a wrapper that delegates to it). Applications that construct structured-fields header values exclusively from trusted, application-controlled values are not affected.\u003c/p\u003e"
}
],
"value": "The application must pass attacker-controlled data as a string value into cow_http_struct_hd:item/1 (or a wrapper that delegates to it). Applications that construct structured-fields header values exclusively from trusted, application-controlled values are not affected."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.9.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Lo\u00efc Hoguin"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027) vulnerability in ninenines cowlib allows HTTP response splitting via non-VCHAR bytes in structured-fields string values.\u003c/p\u003e\u003cp\u003e\u003ctt\u003ecow_http_struct_hd:escape_string/2\u003c/tt\u003e in cowlib only escapes \u003ctt\u003e\\\u003c/tt\u003e and \u003ctt\u003e\"\u003c/tt\u003e, passing all other bytes through verbatim. This creates an encoder/decoder asymmetry: the matching parser accepts only printable ASCII (0x20\u20130x7E, excluding \u003ctt\u003e\"\u003c/tt\u003e and \u003ctt\u003e\\\u003c/tt\u003e), but the encoder emits any byte including CR and LF. An application that builds a structured HTTP header via \u003ctt\u003ecow_http_struct_hd:item/1\u003c/tt\u003e (or a higher-level wrapper such as \u003ctt\u003ecow_http_hd:wt_protocol/1\u003c/tt\u003e) from attacker-controlled input can have \u003ctt\u003e\\r\\n\u003c/tt\u003e injected into the serialized header value. Once on the wire, the injected CRLF terminates the current header and any following bytes are interpreted as a new header, enabling HTTP response splitting.\u003c/p\u003e\u003cp\u003eThis issue affects cowlib from 2.9.0.\u003c/p\u003e"
}
],
"value": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027) vulnerability in ninenines cowlib allows HTTP response splitting via non-VCHAR bytes in structured-fields string values.\n\ncow_http_struct_hd:escape_string/2 in cowlib only escapes \\ and \", passing all other bytes through verbatim. This creates an encoder/decoder asymmetry: the matching parser accepts only printable ASCII (0x20\u20130x7E, excluding \" and \\), but the encoder emits any byte including CR and LF. An application that builds a structured HTTP header via cow_http_struct_hd:item/1 (or a higher-level wrapper such as cow_http_hd:wt_protocol/1) from attacker-controlled input can have \\r\\n injected into the serialized header value. Once on the wire, the injected CRLF terminates the current header and any following bytes are interpreted as a new header, enabling HTTP response splitting.\n\nThis issue affects cowlib from 2.9.0."
}
],
"impacts": [
{
"capecId": "CAPEC-34",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-34 HTTP Response Splitting"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-113",
"description": "CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-09T04:38:15.827Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"related",
"third-party-advisory"
],
"url": "https://cna.erlef.org/cves/CVE-2026-43966.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-43966"
},
{
"tags": [
"mitigation"
],
"url": "https://github.com/ninenines/cowboy/commit/f77cb9b5e730e300fffb551db1ba5d1c4ed878ef"
},
{
"tags": [
"mitigation"
],
"url": "https://github.com/ninenines/gun/commit/4f35609eb37109b106a863fc9ba83d7ee64e3e42"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eValidate all values passed into structured-fields header builders (directly via \u003ctt\u003ecow_http_struct_hd:item/1\u003c/tt\u003e or indirectly via higher-level wrappers) before calling the encoder. Reject any value that is not from a trusted, application-controlled source or that contains CR (\u003ctt\u003e\\r\u003c/tt\u003e) or LF (\u003ctt\u003e\\n\u003c/tt\u003e) bytes.\u003c/p\u003e\u003cp\u003eApplications using cowboy 2.16.0 or later are protected on the server side by the \u003ctt\u003einvalid_response_headers\u003c/tt\u003e option (defaults to \u003ctt\u003eerror_terminate\u003c/tt\u003e), which rejects any outgoing response header value containing CR or LF before it reaches the wire. Applications using gun 2.4.0 or later are protected on the client side by the \u003ctt\u003einvalid_request_headers\u003c/tt\u003e request option (defaults to \u003ctt\u003eraise\u003c/tt\u003e), which raises an exception when an outgoing request header value contains CR or LF.\u003c/p\u003e"
}
],
"value": "Validate all values passed into structured-fields header builders (directly via cow_http_struct_hd:item/1 or indirectly via higher-level wrappers) before calling the encoder. Reject any value that is not from a trusted, application-controlled source or that contains CR (\\r) or LF (\\n) bytes.\n\nApplications using cowboy 2.16.0 or later are protected on the server side by the invalid_response_headers option (defaults to error_terminate), which rejects any outgoing response header value containing CR or LF before it reaches the wire. Applications using gun 2.4.0 or later are protected on the client side by the invalid_request_headers request option (defaults to raise), which raises an exception when an outgoing request header value contains CR or LF."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-43966",
"datePublished": "2026-06-08T16:34:33.364Z",
"dateReserved": "2026-05-04T18:23:25.573Z",
"dateUpdated": "2026-06-09T04:38:15.827Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-43966\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-08T18:37:59.853576Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-08T18:38:04.203Z\"}}], \"cna\": {\"title\": \"HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Peter Ullrich\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Lo\\u00efc Hoguin\"}], \"impacts\": [{\"capecId\": \"CAPEC-34\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-34 HTTP Response Splitting\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 6.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"LOW\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/ninenines/cowlib\", \"vendor\": \"ninenines\", \"modules\": [\"cow_http_struct_hd\"], \"product\": \"cowlib\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.9.0\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:hex/cowlib\", \"packageName\": \"cowlib\", \"programFiles\": [\"src/cow_http_struct_hd.erl\"], \"collectionURL\": \"https://repo.hex.pm\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"cow_http_struct_hd:escape_string/2\"}, {\"name\": \"cow_http_struct_hd:bare_item/1\"}]}, {\"cpes\": [\"cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/ninenines/cowlib\", \"vendor\": \"ninenines\", \"modules\": [\"cow_http_struct_hd\"], \"product\": \"cowlib\", \"versions\": [{\"status\": \"affected\", \"version\": \"a8b793db3d6ffe91d62f81baf41b1dab4cd78fb6\", \"versionType\": \"git\"}], \"packageURL\": \"pkg:github/ninenines/cowlib\", \"packageName\": \"ninenines/cowlib\", \"programFiles\": [\"src/cow_http_struct_hd.erl\"], \"collectionURL\": \"https://github.com\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"cow_http_struct_hd:escape_string/2\"}, {\"name\": \"cow_http_struct_hd:bare_item/1\"}]}], \"references\": [{\"url\": \"https://cna.erlef.org/cves/CVE-2026-43966.html\", \"tags\": [\"related\", \"third-party-advisory\"]}, {\"url\": \"https://osv.dev/vulnerability/EEF-CVE-2026-43966\", \"tags\": [\"related\"]}, {\"url\": \"https://github.com/ninenines/cowboy/commit/f77cb9b5e730e300fffb551db1ba5d1c4ed878ef\", \"tags\": [\"mitigation\"]}, {\"url\": \"https://github.com/ninenines/gun/commit/4f35609eb37109b106a863fc9ba83d7ee64e3e42\", \"tags\": [\"mitigation\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Validate all values passed into structured-fields header builders (directly via cow_http_struct_hd:item/1 or indirectly via higher-level wrappers) before calling the encoder. Reject any value that is not from a trusted, application-controlled source or that contains CR (\\\\r) or LF (\\\\n) bytes.\\n\\nApplications using cowboy 2.16.0 or later are protected on the server side by the invalid_response_headers option (defaults to error_terminate), which rejects any outgoing response header value containing CR or LF before it reaches the wire. Applications using gun 2.4.0 or later are protected on the client side by the invalid_request_headers request option (defaults to raise), which raises an exception when an outgoing request header value contains CR or LF.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eValidate all values passed into structured-fields header builders (directly via \u003ctt\u003ecow_http_struct_hd:item/1\u003c/tt\u003e or indirectly via higher-level wrappers) before calling the encoder. Reject any value that is not from a trusted, application-controlled source or that contains CR (\u003ctt\u003e\\\\r\u003c/tt\u003e) or LF (\u003ctt\u003e\\\\n\u003c/tt\u003e) bytes.\u003c/p\u003e\u003cp\u003eApplications using cowboy 2.16.0 or later are protected on the server side by the \u003ctt\u003einvalid_response_headers\u003c/tt\u003e option (defaults to \u003ctt\u003eerror_terminate\u003c/tt\u003e), which rejects any outgoing response header value containing CR or LF before it reaches the wire. Applications using gun 2.4.0 or later are protected on the client side by the \u003ctt\u003einvalid_request_headers\u003c/tt\u003e request option (defaults to \u003ctt\u003eraise\u003c/tt\u003e), which raises an exception when an outgoing request header value contains CR or LF.\u003c/p\u003e\", \"base64\": false}]}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027) vulnerability in ninenines cowlib allows HTTP response splitting via non-VCHAR bytes in structured-fields string values.\\n\\ncow_http_struct_hd:escape_string/2 in cowlib only escapes \\\\ and \\\", passing all other bytes through verbatim. This creates an encoder/decoder asymmetry: the matching parser accepts only printable ASCII (0x20\\u20130x7E, excluding \\\" and \\\\), but the encoder emits any byte including CR and LF. An application that builds a structured HTTP header via cow_http_struct_hd:item/1 (or a higher-level wrapper such as cow_http_hd:wt_protocol/1) from attacker-controlled input can have \\\\r\\\\n injected into the serialized header value. Once on the wire, the injected CRLF terminates the current header and any following bytes are interpreted as a new header, enabling HTTP response splitting.\\n\\nThis issue affects cowlib from 2.9.0.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eImproper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027) vulnerability in ninenines cowlib allows HTTP response splitting via non-VCHAR bytes in structured-fields string values.\u003c/p\u003e\u003cp\u003e\u003ctt\u003ecow_http_struct_hd:escape_string/2\u003c/tt\u003e in cowlib only escapes \u003ctt\u003e\\\\\u003c/tt\u003e and \u003ctt\u003e\\\"\u003c/tt\u003e, passing all other bytes through verbatim. This creates an encoder/decoder asymmetry: the matching parser accepts only printable ASCII (0x20\\u20130x7E, excluding \u003ctt\u003e\\\"\u003c/tt\u003e and \u003ctt\u003e\\\\\u003c/tt\u003e), but the encoder emits any byte including CR and LF. An application that builds a structured HTTP header via \u003ctt\u003ecow_http_struct_hd:item/1\u003c/tt\u003e (or a higher-level wrapper such as \u003ctt\u003ecow_http_hd:wt_protocol/1\u003c/tt\u003e) from attacker-controlled input can have \u003ctt\u003e\\\\r\\\\n\u003c/tt\u003e injected into the serialized header value. Once on the wire, the injected CRLF terminates the current header and any following bytes are interpreted as a new header, enabling HTTP response splitting.\u003c/p\u003e\u003cp\u003eThis issue affects cowlib from 2.9.0.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-113\", \"description\": \"CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"The application must pass attacker-controlled data as a string value into cow_http_struct_hd:item/1 (or a wrapper that delegates to it). Applications that construct structured-fields header values exclusively from trusted, application-controlled values are not affected.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eThe application must pass attacker-controlled data as a string value into \u003ctt\u003ecow_http_struct_hd:item/1\u003c/tt\u003e (or a wrapper that delegates to it). Applications that construct structured-fields header values exclusively from trusted, application-controlled values are not affected.\u003c/p\u003e\", \"base64\": false}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"2.9.0\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"shortName\": \"EEF\", \"dateUpdated\": \"2026-06-08T16:38:17.405Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-43966\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-08T18:38:08.160Z\", \"dateReserved\": \"2026-05-04T18:23:25.573Z\", \"assignerOrgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"datePublished\": \"2026-06-08T16:34:33.364Z\", \"assignerShortName\": \"EEF\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…