CVE-2026-43966
HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2
Description
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in ninenines cowlib allows HTTP response splitting via non-VCHAR bytes in structured-fields string values. cow_http_struct_hd:escape_string/2 in cowlib only escapes \ and ", passing all other bytes through verbatim. This creates an encoder/decoder asymmetry: the matching parser accepts only printable ASCII (0x20–0x7E, excluding " and \), but the encoder emits any byte including CR and LF. An application that builds a structured HTTP header via cow_http_struct_hd:item/1 (or a higher-level wrapper such as cow_http_hd:wt_protocol/1) from attacker-controlled input can have \r\n injected into the serialized header value. Once on the wire, the injected CRLF terminates the current header and any following bytes are interpreted as a new header, enabling HTTP response splitting. This issue affects cowlib from 2.9.0.
INFO
Published Date :
June 8, 2026, 5:16 p.m.
Last Modified :
July 23, 2026, 7:10 a.m.
Remotely Exploit :
Yes !
Source :
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 4.0 | MEDIUM | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db | ||||
| CVSS 4.0 | MEDIUM | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db |
Solution
- Update cowlib to a version that properly escapes CRLF characters.
- Validate and sanitize all user-controlled input for header values.
- Implement strict header validation to reject unexpected characters.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-43966.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-43966 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-43966
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-43966 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-43966 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Jul. 23, 2026
Action Type Old Value New Value Added Translation Title: cowlib de ninenines, Description: La vulnerabilidad de Neutralización Incorrecta de Secuencias CRLF en Encabezados HTTP ('División de Solicitud/Respuesta HTTP') en ninenines cowlib permite la división de respuesta HTTP a través de bytes no VCHAR en valores de cadena de campos estructurados. cow_http_struct_hd:escape_string/2 en cowlib solo escapa \ y ", pasando todos los demás bytes textualmente. Esto crea una asimetría de codificador/decodificador: el analizador coincidente acepta solo ASCII imprimible (0x20-0x7E, excluyendo " y \), pero el codificador emite cualquier byte, incluidos CR y LF. Una aplicación que construye un encabezado HTTP estructurado a través de cow_http_struct_hd:item/1 (o un envoltorio de nivel superior como cow_http_hd:wt_protocol/1) desde una entrada controlada por el atacante puede tener \r\n inyectado en el valor del encabezado serializado. Una vez en la red, el CRLF inyectado termina el encabezado actual y cualquier byte siguiente se interpreta como un nuevo encabezado, lo que permite la división de respuesta HTTP. Este problema afecta a cowlib desde la versión 2.9.0. -
CVE Modified by 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'cpes': ['cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*'], 'repo': 'https://github.com/ninenines/cowlib', 'vendor': 'ninenines', 'modules': ['cow_http_struct_hd'], 'product': 'cowlib', 'versions': [{'status': 'affected', 'version': '2.9.0', 'versionType': 'semver'}], 'packageURL': 'pkg:hex/cowlib', 'packageName': 'cowlib', 'programFiles': ['src/cow_http_struct_hd.erl'], 'collectionURL': 'https://repo.hex.pm', 'defaultStatus': 'unaffected', 'programRoutines': [{'name': 'cow_http_struct_hd:escape_string/2'}, {'name': 'cow_http_struct_hd:bare_item/1'}]}, {'cpes': ['cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*'], 'repo': 'https://github.com/ninenines/cowlib', 'vendor': 'ninenines', 'modules': ['cow_http_struct_hd'], 'product': 'cowlib', 'versions': [{'status': 'affected', 'version': 'a8b793db3d6ffe91d62f81baf41b1dab4cd78fb6', 'versionType': 'git'}], 'packageURL': 'pkg:github/ninenines/cowlib', 'packageName': 'ninenines/cowlib', 'programFiles': ['src/cow_http_struct_hd.erl'], 'collectionURL': 'https://github.com', 'defaultStatus': 'unaffected', 'programRoutines': [{'name': 'cow_http_struct_hd:escape_string/2'}, {'name': 'cow_http_struct_hd:bare_item/1'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-43966', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-06-08T18:37:59.853576Z'} -
New CVE Received by 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Jun. 08, 2026
Action Type Old Value New Value Added Description Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in ninenines cowlib allows HTTP response splitting via non-VCHAR bytes in structured-fields string values. cow_http_struct_hd:escape_string/2 in cowlib only escapes \ and ", passing all other bytes through verbatim. This creates an encoder/decoder asymmetry: the matching parser accepts only printable ASCII (0x20–0x7E, excluding " and \), but the encoder emits any byte including CR and LF. An application that builds a structured HTTP header via cow_http_struct_hd:item/1 (or a higher-level wrapper such as cow_http_hd:wt_protocol/1) from attacker-controlled input can have \r\n injected into the serialized header value. Once on the wire, the injected CRLF terminates the current header and any following bytes are interpreted as a new header, enabling HTTP response splitting. This issue affects cowlib from 2.9.0. Added CVSS V4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-113 Added Reference https://cna.erlef.org/cves/CVE-2026-43966.html Added Reference https://github.com/ninenines/cowboy/commit/f77cb9b5e730e300fffb551db1ba5d1c4ed878ef Added Reference https://github.com/ninenines/gun/commit/4f35609eb37109b106a863fc9ba83d7ee64e3e42 Added Reference https://osv.dev/vulnerability/EEF-CVE-2026-43966