Executive brief
ninenines cowlib is a library used by Erlang applications to handle HTTP headers and cookies. A vulnerability in how it creates cookie headers allows an attacker to inject malicious characters if they can control cookie names or values. This could lead to 'cookie smuggling,' where an attacker tricks a server into accepting fake credentials, or 'request splitting,' which can bypass security filters or interfere with web proxy operations.
Technical details
A CRLF injection vulnerability exists in cowlib's cow_cookie:cookie/1 function, which builds client-side Cookie request headers. The encoder fails to validate name-value pairs, allowing the injection of control characters such as CR, LF, TAB, semicolons, and commas. An attacker who can influence the input to this function can perform cookie smuggling by injecting phantom cookies (e.g., '; admin=1') or HTTP request splitting by injecting CRLF sequences to append arbitrary headers or smuggle entire requests through upstream proxies. While the decoder and setcookie/3 functions already include validation, the encoder remains vulnerable in versions starting from 2.9.0. A patch is available in the project's repository.
Affected products
- ninenines cowlib >= 2.9.0, <= 2.16.1
Timeline
- 2026-05-11: disclosed
- 2026-05-11: advisory
- 2026-05-11: patched: Patch commit 177953d released