---
id: CVE-2026-43966
title: >-
  Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP
  Request/Response Splitting') vulnerability in ninenines cowlib allows HTTP
  response splitting via non-VCHAR bytes in structured-fields string values.


  cow_http_struct_hd:es…
summary: >-
  Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP
  Request/Response Splitting') vulnerability in ninenines cowlib allows HTTP
  response splitting via non-VCHAR bytes in structured-fields string values.


  cow_http_struct_hd:es…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-113
vendor: ninenines
product: cowlib
affected:
  - 'cowlib >= 2.9.0, < 2.16.0'
patched:
  - cowlib 2.16.0
published: '2026-06-08'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T10:17:53.653'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-43966'
references:
  - url: 'https://cna.erlef.org/cves/CVE-2026-43966.html'
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/ninenines/cowboy/commit/f77cb9b5e730e300fffb551db1ba5d1c4ed878ef
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/ninenines/cowlib/commit/4401b858f2229abb3ea115c60924f6c77e5f8aa3
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/ninenines/cowlib/commit/a8b793db3d6ffe91d62f81baf41b1dab4cd78fb6
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/ninenines/gun/commit/4f35609eb37109b106a863fc9ba83d7ee64e3e42
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: 'https://osv.dev/vulnerability/EEF-CVE-2026-43966'
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
tags:
  - nvd
epss: 0.00433
epssPercentile: 0.35833
ingestedAt: '2026-10-14T10:25:41.198Z'
---

## Overview

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in ninenines cowlib allows HTTP response splitting via non-VCHAR bytes in structured-fields string values.

cow_http_struct_hd:escape_string/2 in cowlib only escapes \ and ", passing all other bytes through verbatim. This creates an encoder/decoder asymmetry: the matching parser accepts only printable ASCII (0x20–0x7E, excluding " and \), but the encoder emits any byte including CR and LF. An application that builds a structured HTTP header via cow_http_struct_hd:item/1 (or a higher-level wrapper such as cow_http_hd:wt_protocol/1) from attacker-controlled input can have \r\n injected into the serialized header value. Once on the wire, the injected CRLF terminates the current header and any following bytes are interpreted as a new header, enabling HTTP response splitting.

This issue affects cowlib: from 2.9.0 onward.

## Affected

- `cowlib >= 2.9.0, < 2.16.0`

## Remediation

Upgrade past the affected range:

- `cowlib 2.16.0`