Improper Encoding Vulnerability in Cowlib by Erlang Solutions

CVE-2026-43971

What is CVE-2026-43971?

The improper encoding or escaping of output in Cowlib allows attackers to exploit Link header directives by injecting unescaped special characters. This vulnerability enables attackers to smuggle malicious Link headers, influencing browser behavior and potentially directing users to compromised destinations. By manipulating the interpolation of the target URI, rel values, and attribute keys into the serialized Link header, an attacker can manipulate browsers into making unintended connections to their controlled origins. This flaw affects all versions of Cowlib from 2.9.0 onward.

References