HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in ninenines cowlib allows HTTP response splitting via non-VCHAR bytes in structured-fields string values. cow_http_struct_hd:escape_string/2 in cowlib only escapes \ and ", passing all other bytes through verbatim. This creates an encoder/decoder asymmetry: the matching parser accepts only printable ASCII (0x20–0x7E, excluding " and \), but the encoder emits any byte including CR and LF. An application that builds a structured HTTP header via cow_http_struct_hd:item/1 (or a higher-level wrapper such as cow_http_hd:wt_protocol/1) from attacker-controlled input can have \r\n injected into the serialized header value. Once on the wire, the injected CRLF terminates the current header and any following bytes are interpreted as a new header, enabling HTTP response splitting. This issue affects cowlib: from 2.9.0 onward.
CVE-2026-43966
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-43966
cowlib
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
cowlib
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"cpes": [
"cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"
],
"repo": "https://github.com/ninenines/cowlib",
"vendor": "ninenines",
"modules": [
"cow_http_struct_hd"
],
"product": "cowlib",
"versions": [
{
"status": "affected",
"version": "2.9.0",
"lessThan": "*",
"versionType": "semver"
}
],
"packageURL": "pkg:hex/cowlib",
"packageName": "cowlib",
"programFiles": [
"src/cow_http_struct_hd.erl"
],
"collectionURL": "https://repo.hex.pm",
"defaultStatus": "unaffected",
"programRoutines": [
{
"name": "cow_http_struct_hd:escape_string/2"
},
{
"name": "cow_http_struct_hd:bare_item/1"
}
]
},
{
"cpes": [
"cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"
],
"repo": "https://github.com/ninenines/cowlib",
"vendor": "ninenines",
"modules": [
"cow_http_struct_hd"
],
"product": "cowlib",
"versions": [
{
"status": "affected",
"version": "a8b793db3d6ffe91d62f81baf41b1dab4cd78fb6",
"lessThan": "4401b858f2229abb3ea115c60924f6c77e5f8aa3",
"versionType": "git"
}
],
"packageURL": "pkg:github/ninenines/cowlib",
"packageName": "ninenines/cowlib",
"programFiles": [
"src/cow_http_struct_hd.erl"
],
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"programRoutines": [
{
"name": "cow_http_struct_hd:escape_string/2"
},
{
"name": "cow_http_struct_hd:bare_item/1"
}
]
}
]- Related CVEs
- CVE-2026-43966
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #21584 · Revision 1
- Added to Heist Feed
- Publisher date