← Back to CVE Explorer

CVE-2026-43971

Full vulnerability record from the local CVENow database.

Description

Improper Encoding or Escaping of Output vulnerability in ninenines cowlib allows Link header directive smuggling via unescaped special characters in cow_link:link/1. cow_link:do_link/1 in cowlib interpolates the target URI, rel value, and attribute keys directly into the serialized Link: header value without escaping or token-grammar validation. A > byte in target prematurely closes the URI slot, allowing an attacker to append additional link entries with attacker-chosen rel directives. A " or \ in rel escapes the quoted string and opens new parameters. Any byte — including whitespace, =, and " — in an attribute key is emitted verbatim. Because browsers act on Link: directives such as rel="preconnect", rel="preload", and rel="prerender", an attacker who can influence these fields in an application that round-trips parsed Link headers through cow_link:link/1 can force victim browsers to make out-of-band connections to attacker-controlled origins. This issue affects cowlib: from 2.9.0 before 2.20.0.

Severity
MEDIUM
CVSS score
6.3 (v4.0)
Vulnerability status
Awaiting Analysis
Source identifier
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Published
2026-08-18 09:17:14.340000
Last modified
2026-10-22 22:10:00.250000
View original CVE JSON 
{
  "id": "CVE-2026-43971",
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "published": "2026-08-18T09:17:14.340",
  "lastModified": "2026-10-22T22:10:00.250",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Encoding or Escaping of Output vulnerability in ninenines cowlib allows Link header directive smuggling via unescaped special characters in cow_link:link/1.\n\ncow_link:do_link/1 in cowlib interpolates the target URI, rel value, and attribute keys directly into the serialized Link: header value without escaping or token-grammar validation. A > byte in target prematurely closes the URI slot, allowing an attacker to append additional link entries with attacker-chosen rel directives. A \" or \\ in rel escapes the quoted string and opens new parameters. Any byte — including whitespace, =, and \" — in an attribute key is emitted verbatim. Because browsers act on Link: directives such as rel=\"preconnect\", rel=\"preload\", and rel=\"prerender\", an attacker who can influence these fields in an application that round-trips parsed Link headers through cow_link:link/1 can force victim browsers to make out-of-band connections to attacker-controlled origins.\n\nThis issue affects cowlib: from 2.9.0 before 2.20.0."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de codificación o escape de salida incorrectos en ninenines cowlib permite el contrabando de directivas de encabezado Link a través de caracteres especiales sin escape en cow_link:link/1.\n\ncow_link:do_link/1 en cowlib interpola la URI de destino, el valor rel y las claves de atributo directamente en el valor del encabezado Link: serializado sin escape ni validación de gramática de tokens. Un byte > en el destino cierra prematuramente la ranura URI, permitiendo a un atacante añadir entradas de enlace adicionales con directivas rel elegidas por el atacante. Un ’ o \\ en rel escapa la cadena entre comillas y abre nuevos parámetros. Cualquier byte -incluyendo espacios en blanco, =, y ’- en una clave de atributo se emite textualmente. Debido a que los navegadores actúan sobre directivas Link: como rel=’preconnect’, rel=’preload’ y rel=’prerender’, un atacante que puede influir en estos campos en una aplicación que procesa encabezados Link analizados a través de cow_link:link/1 puede forzar a los navegadores de las víctimas a realizar conexiones fuera de banda a orígenes controlados por el atacante.\n\nEste problema afecta a cowlib: a partir de la versión 2.9.0."
    }
  ],
  "affected": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "affectedData": [
        {
          "vendor": "ninenines",
          "product": "cowlib",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.hex.pm",
          "packageName": "cowlib",
          "cpes": [
            "cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "cow_link"
          ],
          "programFiles": [
            "src/cow_link.erl"
          ],
          "programRoutines": [
            {
              "name": "cow_link:link/1"
            },
            {
              "name": "cow_link:do_link/1"
            },
            {
              "name": "cow_link:escape/2"
            }
          ],
          "repo": "https://github.com/ninenines/cowlib",
          "packageURL": "pkg:hex/cowlib",
          "versions": [
            {
              "version": "2.9.0",
              "lessThan": "2.20.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "ninenines",
          "product": "cowlib",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com",
          "packageName": "ninenines/cowlib",
          "cpes": [
            "cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "cow_link"
          ],
          "programFiles": [
            "src/cow_link.erl"
          ],
          "programRoutines": [
            {
              "name": "cow_link:link/1"
            },
            {
              "name": "cow_link:do_link/1"
            },
            {
              "name": "cow_link:escape/2"
            }
          ],
          "repo": "https://github.com/ninenines/cowlib",
          "packageURL": "pkg:github/ninenines/cowlib",
          "versions": [
            {
              "version": "485d58dfa91b91d98135dc95e5615f421715dae5",
              "lessThan": "89da27ee4c241f5d649ba7d9b7f2188918af6cea",
              "versionType": "git",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "LOW",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-18T14:11:55.645955Z",
          "id": "CVE-2026-43971",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-116"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://cna.erlef.org/cves/CVE-2026-43971.html",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/ninenines/cowlib/commit/485d58dfa91b91d98135dc95e5615f421715dae5",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/ninenines/cowlib/commit/89da27ee4c241f5d649ba7d9b7f2188918af6cea",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-43971",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    }
  ]
}