CVE-2026-43966 HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2

What is CVE-2026-43966?

CVE-2026-43966 is a medium-severity vulnerability in ninenines cowlib, published on 8 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in ninenines cowlib allows HTTP response splitting via non-VCHAR bytes in structured-fields string values.

cow_http_struct_hd:escape_string/2 in cowlib only escapes \ and ", passing all other bytes through verbatim. This creates an encoder/decoder asymmetry: the matching parser accepts only printable ASCII (0x20–0x7E, excluding " and \), but the encoder emits any byte including CR and LF. An application that builds a structured HTTP header via cow_http_struct_hd:item/1 (or a higher-level wrapper such as cow_http_hd:wt_protocol/1) from attacker-controlled input can have \r\n injected into the serialized header value. Once on the wire, the injected CRLF terminates the current header and any following bytes are interpreted as a new header, enabling HTTP response splitting.

This issue affects cowlib: from 2.9.0 onward.

Weakness: CWE-113

Which versions are affected by CVE-2026-43966?

5 open source packages ship an affected version, including cowlib, cowboy and gun. It affects 1 product.

Products include Ninenines Cowlib.

How do I fix CVE-2026-43966?

Apply the vendor's patch.

Is CVE-2026-43966 being exploited?

There is no known exploitation of CVE-2026-43966 in the wild and no public exploit code.

Other vulnerabilities in ninenines cowlib

• CVE-2026-7790 Unbounded chunk-size hex digits in cowlib cause quadratic CPU and memory DoS High 8.7
• CVE-2026-43968 CR Injection in SSE Encoder Enables Event Splitting via cow_sse:event/1 Medium 6.3
• CVE-2026-43969 Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1 Low 2.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-90162, DEBIAN-CVE-2026-43966, EEF-CVE-2026-43966, GHSA-w4f7-4cxr-rv3c.