CRLF Injection Vulnerability in ninenines' Cowlib Product

CVE-2026-43969

What is CVE-2026-43969?

The cowlib library developed by ninenines is vulnerable due to improper handling of CRLF sequences within cookie name and value fields. This deficiency allows attackers to perform cookie smuggling and HTTP request splitting attacks. Specifically, an adversary can manipulate cookie headers by injecting CR, LF, TAB, or separator characters, leading to unauthorized actions such as introducing phantom cookies that can be mistaken for legitimate ones by the server. Consequently, this vulnerability poses a significant risk when unvalidated cookie information is processed, as it permits the attacker to execute malicious HTTP headers or relay an entire second request through a shared upstream proxy.

References