Quick answers
- Is CVE-2026-43966 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-43966 being exploited in the wild.
- How severe is CVE-2026-43966?
- Medium severity, with a CVSS score of 6.3, published 8 June 2026.
- Which products and versions are affected?
- Nine Nines Cowlib 2.9.0.
- Is there a fix for CVE-2026-43966?
- A patch was published on 2026-07-29. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-43966 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-43966?
- Check whether you run Nine Nines Cowlib at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An encoder/decoder asymmetry exists in cowlib's cow_http_struct_hd:escape_string/2 function. While the parser correctly restricts input to printable ASCII, the encoder fails to escape carriage return (CR) and line feed (LF) characters, passing them through verbatim. An attacker providing input to functions like cow_http_struct_hd:item/1 can inject CRLF sequences into serialized headers. When processed by a downstream proxy or browser, these sequences terminate the current header and start a new one, enabling HTTP response splitting or request smuggling. Patches are available in Cowboy 2.16.0 and Gun 2.4.0.
Affected products
- ninenines cowlib >= 2.9.0
- ninenines cowboy < 2.16.0
- ninenines gun < 2.4.0
Identifiers
- CVE-2026-43966
- GHSA-w4f7-4cxr-rv3c
Timeline
- 2026-06-08: disclosed
- 2026-06-08: advisory
- 2026-07-29: patched