CVE-2026-43969

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows HTTP request splitting and cookie smuggling via unvalidated cookie name and value fields. cow_cookie:cookie/1 in cowlib builds a client-side Cookie: request header from a list of name-value pairs without validating either field. An attacker who controls the cookie names or values passed to this function can inject ;, ,, CR, LF, or TAB characters into the serialized header. This enables two classes of attack: cookie smuggling within a single header (e.g. injecting "; admin=1" to introduce a phantom cookie that the receiving server treats as authentic) and HTTP request header splitting (injecting CRLF to append arbitrary headers or smuggle a complete second request against a shared upstream proxy). The decoder side (parse_cookie_name/1, parse_cookie_value/1) and setcookie/3 already validate and reject these characters; the encoder alone is missing the check. This issue affects cowlib from 2.9.0.

• CWE-93

• https://cna.erlef.org/cves/CVE-2026-43969.htmlVendor Advisory
• https://github.com/erlef/cowlib/commit/177953dd51540da11090666c1f007214127a1144Patch
• https://osv.dev/vulnerability/EEF-CVE-2026-43969Third Party Advisory

Published

May 11, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4396Improper certificate validation in Devolutions Hub Reporting…8.1
• CVE-2026-43964Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.…7.5
• CVE-2026-43965Path traversal vulnerability in Gleam's dependency managemen…5.6
• CVE-2026-43966Improper Neutralization of CRLF Sequences in HTTP Headers ('…6.3
• CVE-2026-43967Inefficient Algorithmic Complexity vulnerability in absinthe…7.5
• CVE-2026-43968Improper Neutralization of CRLF Sequences ('CRLF Injection')…4
• CVE-2026-43970Improper Handling of Highly Compressed Data (Data Amplificat…8.2
• CVE-2026-43972Origin Validation Error vulnerability in ninenines gun (gun_…6.3
• CVE-2026-43973Uncontrolled Resource Consumption vulnerability in ninenines…8.7
• CVE-2026-43974Unexpected Status Code or Return Value vulnerability in nine…8.7
• CVE-2026-43975FolderUploadsFileManager in Apache Wicket does not validate …6.5
• CVE-2026-43977wger is a free, open-source workout and fitness manager. In …7.5