CVE-2026-43971

Name of the Vulnerable Software and Affected Versions cowlib versions 2.9.0 and later

Description Improper encoding or escaping of output in the cow link:link/1 function allows Link header directive smuggling. The cow link:do link/1 function interpolates the target URI, rel value, and attribute keys directly into the serialized Link header without escaping or token-grammar validation. Specifically, a > byte in the target can prematurely close the URI slot, enabling the addition of unauthorized link entries. Additionally, a " or `` in the rel value can escape the quoted string to open new parameters, and any byte in an attribute key is emitted verbatim. This can force browsers to make out-of-band connections to attacker-controlled origins through directives such as rel="preconnect", rel="preload", and rel="prerender".

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.