HTTP Response Splitting Vulnerability in Ninenines Cowlib

CVE-2026-43966

What is CVE-2026-43966?

The vulnerability in Ninenines Cowlib relates to improper handling of CRLF sequences in HTTP headers, known as HTTP response splitting. This occurs when structured fields allow non-printable characters to bypass normal escaping procedures, particularly the and bytes, leading to potential injection of malicious headers. Applications utilizing cow_http_struct_hd:item/1 or similar interfaces that process untrusted input may inadvertently create malformed headers. Consequently, attackers can manipulate HTTP responses to perform unauthorized actions, potentially leading to data leakage or other security risks.

References