← Back to CVE Explorer

CVE-2026-43969

Full vulnerability record from the local CVENow database.

Description

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows HTTP request splitting and cookie smuggling via unvalidated cookie name and value fields. cow_cookie:cookie/1 in cowlib builds a client-side Cookie: request header from a list of name-value pairs without validating either field. An attacker who controls the cookie names or values passed to this function can inject ;, ,, CR, LF, or TAB characters into the serialized header. This enables two classes of attack: cookie smuggling within a single header (e.g. injecting ; admin=1 to introduce a phantom cookie that the receiving server treats as authentic) and HTTP request header splitting (injecting CRLF to append arbitrary headers or smuggle a complete second request against a shared upstream proxy). The decoder side (parse_cookie_name/1, parse_cookie_value/1) and setcookie/3 already validate and reject these characters; the encoder alone is missing the check. This issue affects cowlib: from 2.9.0 before 2.21.0.

Severity
LOW
CVSS score
2.1 (v4.0)
Vulnerability status
Modified
Source identifier
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Published
2026-05-11 19:16:25.330000
Last modified
2026-10-26 20:10:00.160000
View original CVE JSON 
{
  "id": "CVE-2026-43969",
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "published": "2026-05-11T19:16:25.330",
  "lastModified": "2026-10-26T20:10:00.160",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows HTTP request splitting and cookie smuggling via unvalidated cookie name and value fields.\n\ncow_cookie:cookie/1 in cowlib builds a client-side Cookie: request header from a list of name-value pairs without validating either field. An attacker who controls the cookie names or values passed to this function can inject ;, ,, CR, LF, or TAB characters into the serialized header. This enables two classes of attack: cookie smuggling within a single header (e.g. injecting ; admin=1 to introduce a phantom cookie that the receiving server treats as authentic) and HTTP request header splitting (injecting CRLF to append arbitrary headers or smuggle a complete second request against a shared upstream proxy). The decoder side (parse_cookie_name/1, parse_cookie_value/1) and setcookie/3 already validate and reject these characters; the encoder alone is missing the check.\n\nThis issue affects cowlib: from 2.9.0 before 2.21.0."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de neutralización inadecuada de secuencias CRLF (’Inyección CRLF’) en ninenines cowlib permite la división de solicitudes HTTP y el contrabando de cookies a través de campos de nombre y valor de cookie no validados.\n\ncow_cookie:cookie/1 en cowlib construye una cabecera de solicitud Cookie: del lado del cliente a partir de una lista de pares nombre-valor sin validar ninguno de los campos. Un atacante que controla los nombres o valores de las cookies pasados a esta función puede inyectar los caracteres ;, ,, CR, LF o TAB en la cabecera serializada. Esto permite dos clases de ataque: el contrabando de cookies dentro de una única cabecera (por ejemplo, inyectando ; admin=1 para introducir una cookie fantasma que el servidor receptor trata como auténtica) y la división de cabeceras de solicitud HTTP (inyectando CRLF para añadir cabeceras arbitrarias o contrabandear una segunda solicitud completa contra un proxy ascendente compartido). El lado del decodificador (parse_cookie_name/1, parse_cookie_value/1) y setcookie/3 ya validan y rechazan estos caracteres; solo el codificador carece de la comprobación.\n\nEste problema afecta a cowlib: desde la versión 2.9.0 hasta versiones anteriores a la 2.21.0."
    }
  ],
  "affected": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "affectedData": [
        {
          "vendor": "ninenines",
          "product": "cowlib",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.hex.pm",
          "packageName": "cowlib",
          "cpes": [
            "cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "cow_cookie"
          ],
          "programFiles": [
            "src/cow_cookie.erl"
          ],
          "programRoutines": [
            {
              "name": "cow_cookie:cookie/1"
            }
          ],
          "repo": "https://github.com/ninenines/cowlib",
          "packageURL": "pkg:hex/cowlib",
          "versions": [
            {
              "version": "2.9.0",
              "lessThan": "2.21.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "ninenines",
          "product": "cowlib",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com",
          "packageName": "ninenines/cowlib",
          "cpes": [
            "cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "cow_cookie"
          ],
          "programFiles": [
            "src/cow_cookie.erl"
          ],
          "programRoutines": [
            {
              "name": "cow_cookie:cookie/1"
            }
          ],
          "repo": "https://github.com/ninenines/cowlib",
          "packageURL": "pkg:github/ninenines/cowlib",
          "versions": [
            {
              "version": "f017f8a0ecbffd5033d9ab49bf180186f7a523a7",
              "lessThan": "c17fd73945ef536cccecc492d286fb6b6d1c3307",
              "versionType": "git",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 2.1,
          "baseSeverity": "LOW",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "LOW",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N",
          "baseScore": 3.2,
          "baseSeverity": "LOW",
          "attackVector": "LOCAL",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.4,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-11T18:55:16.028478Z",
          "id": "CVE-2026-43969",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-93"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "2.9.0",
              "versionEndIncluding": "2.16.1",
              "matchCriteriaId": "7A8FFB7F-B6A8-4AE7-9564-CD6B8D406CEF"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://cna.erlef.org/cves/CVE-2026-43969.html",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/erlef/cowlib/commit/177953dd51540da11090666c1f007214127a1144",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/ninenines/cowlib/commit/c17fd73945ef536cccecc492d286fb6b6d1c3307",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/ninenines/cowlib/commit/f017f8a0ecbffd5033d9ab49bf180186f7a523a7",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-43969",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Third Party Advisory"
      ]
    }
  ]
}