CVE-2026-43969: ninenines cowlib CRLF injection in cow_cookie:cookie/1

CVE-2026-43969 · Severity: low · CVSS 3.2 · Published 2026-05-11

ninenines cowlib is a library used by Erlang applications to handle HTTP headers and cookies. A vulnerability in how it creates cookie headers allows an attacker to inject malicious characters if they can control cookie names or values. This could lead to 'cookie smuggling,' where an attacker tricks a server into accepting fake credentials, or 'request splitting,' which can bypass security filters or interfere with web proxy operations.

Technologies: Nine Nines Cowlib. Vendors: Nine Nines.

Quick answers

Is CVE-2026-43969 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-43969 being exploited in the wild.
How severe is CVE-2026-43969?
Low severity, with a CVSS score of 3.2, published 11 May 2026.
Which products and versions are affected?
Nine Nines Cowlib >= 2.9.0, <= 2.16.1, from 2.9.0.
Is there a fix for CVE-2026-43969?
A patch was published on 2026-05-11: Patch commit 177953d released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-43969 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-43969?
Check whether you run Nine Nines Cowlib at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A CRLF injection vulnerability exists in cowlib's cow_cookie:cookie/1 function, which builds client-side Cookie request headers. The encoder fails to validate name-value pairs, allowing the injection of control characters such as CR, LF, TAB, semicolons, and commas. An attacker who can influence the input to this function can perform cookie smuggling by injecting phantom cookies (e.g., '; admin=1') or HTTP request splitting by injecting CRLF sequences to append arbitrary headers or smuggle entire requests through upstream proxies. While the decoder and setcookie/3 functions already include validation, the encoder remains vulnerable in versions starting from 2.9.0. A patch is available in the project's repository.

Affected products

  • ninenines cowlib >= 2.9.0, <= 2.16.1

Identifiers

  • CVE-2026-43969
  • GHSA-g2wm-735q-3f56

Timeline

  • 2026-05-11: disclosed
  • 2026-05-11: advisory
  • 2026-05-11: patched: Patch commit 177953d released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.