{"id":"CVE-2026-43966","title":"Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in ninenines cowlib allows HTTP response splitting via non-VCHAR bytes in structured-fields string values.\n\ncow_http_struct_hd:es…","summary":"Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in ninenines cowlib allows HTTP response splitting via non-VCHAR bytes in structured-fields string values.\n\ncow_http_struct_hd:es…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cwe":["CWE-113"],"vendor":"ninenines","product":"cowlib","affected":["cowlib >= 2.9.0, < 2.16.0"],"patched":["cowlib 2.16.0"],"published":"2026-06-08","updated":"2026-10-14","sourceUpdated":"2026-10-14T10:17:53.653","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43966","references":[{"url":"https://cna.erlef.org/cves/CVE-2026-43966.html","label":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/ninenines/cowboy/commit/f77cb9b5e730e300fffb551db1ba5d1c4ed878ef","label":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/ninenines/cowlib/commit/4401b858f2229abb3ea115c60924f6c77e5f8aa3","label":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/ninenines/cowlib/commit/a8b793db3d6ffe91d62f81baf41b1dab4cd78fb6","label":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/ninenines/gun/commit/4f35609eb37109b106a863fc9ba83d7ee64e3e42","label":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-43966","label":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}],"tags":["nvd"],"epss":0.00433,"epssPercentile":0.35833,"ingestedAt":"2026-10-14T10:25:41.198Z","slug":"CVE-2026-43966","body":"## Overview\n\nImproper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in ninenines cowlib allows HTTP response splitting via non-VCHAR bytes in structured-fields string values.\n\ncow_http_struct_hd:escape_string/2 in cowlib only escapes \\ and \", passing all other bytes through verbatim. This creates an encoder/decoder asymmetry: the matching parser accepts only printable ASCII (0x20–0x7E, excluding \" and \\), but the encoder emits any byte including CR and LF. An application that builds a structured HTTP header via cow_http_struct_hd:item/1 (or a higher-level wrapper such as cow_http_hd:wt_protocol/1) from attacker-controlled input can have \\r\\n injected into the serialized header value. Once on the wire, the injected CRLF terminates the current header and any following bytes are interpreted as a new header, enabling HTTP response splitting.\n\nThis issue affects cowlib: from 2.9.0 onward.\n\n## Affected\n\n- `cowlib >= 2.9.0, < 2.16.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `cowlib 2.16.0`","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}