CVE-2026-43966

Name of the Vulnerable Software and Affected Versions cowlib versions 2.9.0 and later

Description Improper neutralization of CRLF sequences in HTTP headers allows HTTP response splitting via non-VCHAR bytes in structured-fields string values. The function escape string/2 in cow http struct hd only escapes backslashes and double quotes, passing other bytes verbatim. This creates an asymmetry where the parser accepts only printable ASCII, but the encoder emits any byte, including Carriage Return (CR) and Line Feed (LF). An application building a structured HTTP header via item/1 in cow http struct hd (or wrappers like wt protocol/1 in cow http hd) using attacker-controlled input can have CRLF sequences injected. These sequences terminate the current header, causing subsequent bytes to be interpreted as a new header.

Recommendations For versions 2.9.0 and later, validate all values passed into structured-fields header builders, such as item/1 in cow http struct hd, and reject any values containing CR or LF bytes or those not from a trusted source. As a temporary mitigation, restrict the use of attacker-controlled data within the item/1 function of cow http struct hd.