ninenines cowlib 2.9.0 Matching Parser response splitting

Summaryinfo

A vulnerability classified as problematic has been found in ninenines cowlib 2.9.0. The impacted element is an unknown function of the component Matching Parser. This manipulation causes response splitting. This vulnerability is tracked as CVE-2026-43966. The attack is possible to be carried out remotely. No exploit exists. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability was found in ninenines cowlib 2.9.0. It has been declared as problematic. Affected by this vulnerability is some unknown processing of the component Matching Parser. The manipulation with an unknown input leads to a response splitting vulnerability. The CWE definition for the vulnerability is CWE-113. The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers. As an impact it is known to affect integrity. The summary by CVE is:

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in ninenines cowlib allows HTTP response splitting via non-VCHAR bytes in structured-fields string values. cow_http_struct_hd:escape_string/2 in cowlib only escapes \ and ", passing all other bytes through verbatim. This creates an encoder/decoder asymmetry: the matching parser accepts only printable ASCII (0x20–0x7E, excluding " and \), but the encoder emits any byte including CR and LF. An application that builds a structured HTTP header via cow_http_struct_hd:item/1 (or a higher-level wrapper such as cow_http_hd:wt_protocol/1) from attacker-controlled input can have \r\n injected into the serialized header value. Once on the wire, the injected CRLF terminates the current header and any following bytes are interpreted as a new header, enabling HTTP response splitting. This issue affects cowlib from 2.9.0.

The weakness was disclosed by Peter Ullrich. The advisory is shared at cna.erlef.org. This vulnerability is known as CVE-2026-43966 since 05/04/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available.

Applying the patch a8b793db3d6ffe91d62f81baf41b1dab4cd78fb6 is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-35131). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• ninenines

Name

• cowlib

Version

• 2.9.0

License

• open-source

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion