CVE-2026-43971 in cowlib
Summary
by MITRE • 08/18/2026
Improper Encoding or Escaping of Output vulnerability in ninenines cowlib allows Link header directive smuggling via unescaped special characters in cow_link:link/1.
cow_link:do_link/1 in cowlib interpolates the target URI, rel value, and attribute keys directly into the serialized Link: header value without escaping or token-grammar validation. A > byte in target prematurely closes the URI slot, allowing an attacker to append additional link entries with attacker-chosen rel directives. A " or \ in rel escapes the quoted string and opens new parameters. Any byte — including whitespace, =, and " — in an attribute key is emitted verbatim. Because browsers act on Link: directives such as rel="preconnect", rel="preload", and rel="prerender", an attacker who can influence these fields in an application that round-trips parsed Link headers through cow_link:link/1 can force victim browsers to make out-of-band connections to attacker-controlled origins.
This issue affects cowlib: from 2.9.0 onward.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability identified within the ninenines cowlib library, specifically in the cow_link module's do_link and link functions, represents a critical improper encoding or escaping of output flaw that enables HTTP header smuggling attacks. This issue arises because the function interpolates target URIs, relation type values, and attribute keys directly into the serialized Link: header value without performing any necessary token-grammar validation or character escaping. In compliant HTTP implementations, special characters within header field values must be properly escaped to prevent them from being interpreted as structural delimiters rather than data content. The absence of these safeguards allows an attacker who can influence the input fields passed to this function to inject malicious payloads that alter the structure and meaning of the resulting HTTP response headers.
The technical mechanism of exploitation relies on specific byte sequences breaking out of their intended syntactic slots within the Link header format defined by RFC 5988 and RFC 6297. For instance, if an attacker supplies a greater-than symbol (>) as part of the target URI, this character prematurely closes the angle-bracketed URI slot in the link entry. This closure allows subsequent content to be interpreted as new link entries rather than continuation of the original one. Similarly, providing a double quote or backslash within the rel value escapes the quoted string context, effectively opening up space for injecting additional parameters and directives that were not originally intended by the application logic. Furthermore, any byte sequence including whitespace, equals signs, or quotation marks provided in an attribute key is emitted verbatim without sanitization, further expanding the attack surface for header manipulation.
The operational impact of this vulnerability is significant due to how modern web browsers interpret Link: directives. Browsers actively process specific rel values such as preconnect, preload, and prerender to optimize resource loading by establishing early connections or fetching resources before they are explicitly requested in the HTML body. An attacker who can manipulate these fields through cowlib's unescaped interpolation can force victim browsers to initiate out-of-band network connections to origins controlled by the attacker. This capability facilitates a range of malicious activities including cross-site request forgery amplification, cache poisoning via preloaded resources, and potential data exfiltration if sensitive cookies or authentication tokens are sent with these forced requests. The ability to dictate where the browser connects next undermines the security model relying on same-origin policies and can lead to session hijacking or phishing scenarios that appear legitimate due to the trusted origin of the initial page load.
This vulnerability affects versions of cowlib from 2.9.0 onward, impacting applications built with Erlang or Elixir that utilize this library for HTTP header generation. To mitigate this risk, developers must ensure they are using a patched version of cowlib where proper escaping and validation have been implemented in the link serialization logic. Until an official patch is available or upgraded to, application-level workarounds should be considered, such as manually sanitizing all inputs passed to Link header construction functions by stripping or encoding special characters like greater-than signs, quotes, backslashes, and whitespace before they reach the library function. Additionally, implementing strict Content-Security-Policy headers can help mitigate some of the downstream effects related to preconnect and preload directives, although this does not address the root cause of the header injection itself.
From a classification perspective, this flaw aligns with CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component, as it involves failing to neutralize special characters that could change the interpretation of data. It also relates to CWE-16 Configuration and CWE-20 Improper Input Validation given the lack of token-grammar checks on user-supplied or application-generated header values. In terms of offensive security frameworks, this vulnerability supports techniques associated with ATT&CK T1134 Access Right Manipulation via HTTP Header Injection, allowing attackers to manipulate client-side behavior through server-controlled headers. The severity is heightened by the widespread use of cowlib in high-performance web servers and APIs where Link headers are commonly generated for performance optimization features like resource hints.