Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1
Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows HTTP request splitting and cookie smuggling via unvalidated cookie name and value fields. cow_cookie:cookie/1 in cowlib builds a client-side Cookie: request header from a list of name-value pairs without validating either field. An attacker who controls the cookie names or values passed to this function can inject ;, ,, CR, LF, or TAB characters into the serialized header. This enables two classes of attack: cookie smuggling within a single header (e.g. injecting ; admin=1 to introduce a phantom cookie that the receiving server treats as authentic) and HTTP request header splitting (injecting CRLF to append arbitrary headers or smuggle a complete second request against a shared upstream proxy). The decoder side (parse_cookie_name/1, parse_cookie_value/1) and setcookie/3 already validate and reject these characters; the encoder alone is missing the check. This issue affects cowlib: from 2.9.0 before 2.21.0.
CVE-2026-43969
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-43969
cowlib
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
cowlib
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"cpes": [
"cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"
],
"repo": "https://github.com/ninenines/cowlib",
"vendor": "ninenines",
"modules": [
"cow_cookie"
],
"product": "cowlib",
"versions": [
{
"status": "affected",
"version": "2.9.0",
"lessThan": "2.21.0",
"versionType": "semver"
}
],
"packageURL": "pkg:hex/cowlib",
"packageName": "cowlib",
"programFiles": [
"src/cow_cookie.erl"
],
"collectionURL": "https://repo.hex.pm",
"defaultStatus": "unaffected",
"programRoutines": [
{
"name": "cow_cookie:cookie/1"
}
]
},
{
"cpes": [
"cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"
],
"repo": "https://github.com/ninenines/cowlib",
"vendor": "ninenines",
"modules": [
"cow_cookie"
],
"product": "cowlib",
"versions": [
{
"status": "affected",
"version": "f017f8a0ecbffd5033d9ab49bf180186f7a523a7",
"lessThan": "c17fd73945ef536cccecc492d286fb6b6d1c3307",
"versionType": "git"
}
],
"packageURL": "pkg:github/ninenines/cowlib",
"packageName": "ninenines/cowlib",
"programFiles": [
"src/cow_cookie.erl"
],
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"programRoutines": [
{
"name": "cow_cookie:cookie/1"
}
]
}
]- Related CVEs
- CVE-2026-43969
Source reference:
/cveMetadata/cveId
Publisher severity
low
Source reference: /containers/cna/metrics
- Event
- #16198 · Revision 1
- Added to Heist Feed
- Publisher date