Executive brief
A vulnerability in the cowlib library, used by the Cowboy web server and Gun HTTP client, could allow attackers to manipulate web traffic. By providing specially crafted input, an attacker can inject extra headers into a web response or request. This can lead to security bypasses, such as tricking a browser into seeing a different website or bypassing security filters.
Technical details
An encoder/decoder asymmetry exists in cowlib's cow_http_struct_hd:escape_string/2 function. While the parser correctly restricts input to printable ASCII, the encoder fails to escape carriage return (CR) and line feed (LF) characters, passing them through verbatim. An attacker providing input to functions like cow_http_struct_hd:item/1 can inject CRLF sequences into serialized headers. When processed by a downstream proxy or browser, these sequences terminate the current header and start a new one, enabling HTTP response splitting or request smuggling. Patches are available in Cowboy 2.16.0 and Gun 2.4.0.
Affected products
- ninenines cowlib >= 2.9.0
- ninenines cowboy < 2.16.0
- ninenines gun < 2.4.0
Timeline
- 2026-06-08: disclosed
- 2026-06-08: advisory
- 2026-07-29: patched