CVE-2026-43966 Details
Description
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in ninenines cowlib allows HTTP response splitting via non-VCHAR bytes in structured-fields string values. cow_http_struct_hd:escape_string/2 in cowlib only escapes \ and ", passing all other bytes through verbatim. This creates an encoder/decoder asymmetry: the matching parser accepts only printable ASCII (0x20–0x7E, excluding " and \), but the encoder emits any byte including CR and LF. An application that builds a structured HTTP header via cow_http_struct_hd:item/1 (or a higher-level wrapper such as cow_http_hd:wt_protocol/1) from attacker-controlled input can have \r\n injected into the serialized header value. Once on the wire, the injected CRLF terminates the current header and any following bytes are interpreted as a new header, enabling HTTP response splitting. This issue affects cowlib from 2.9.0.
A vulnerability allowing HTTP response splitting has been identified in ninenines cowlib version 2.9.0 and later. This issue arises from improper handling of non-visible characters in structured-fields string values, which can be exploited to inject carriage return and line feed sequences into HTTP headers. The cow_http_struct_hd:escape_string/2 function fails to adequately escape these bytes, creating a mismatch between the encoding and parsing of header values. As a result, applications that use cow_http_struct_hd:item/1 to build structured HTTP headers from untrusted input may inadvertently introduce CRLF injection, facilitating HTTP response splitting attacks.
Applications can validate and sanitize input before using it in structured-fields headers. For those using cowboy 2.16.0 or later, the invalid_response_headers option can be enabled to reject headers with CR or LF before they are sent. Additionally, gun 2.4.0 or later includes an invalid_request_headers option to raise exceptions for outgoing headers containing CR or LF.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.erlef.org/cves/CVE-2026-43966.html | EEF | Third Party Advisory |
| https://github.com/ninenines/cowboy/commit/f77cb9b5e730e300fffb551db1ba5d1c4ed878ef | EEF | Patch |
| https://github.com/ninenines/gun/commit/4f35609eb37109b106a863fc9ba83d7ee64e3e42 | EEF | Patch |
| https://osv.dev/vulnerability/EEF-CVE-2026-43966 | EEF | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-113 | Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') | EEF |
Affected Products
| Product | Versions |
|---|---|
| ninenines cowlib | >= 2.9.0, < 2.16.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 17, 2026 | Initial Analysis | [email protected] |
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | EEF |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 8, 2026 | New CVE Received | EEF |