Vulnerability · Published Jun 8, 2026 · Assigned by EEF
CVE-2026-43966HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2
Medium 6.3
In plain English
A medium-severity security flaw in cowlib from ninenines. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in ninenines cowlib allows HTTP response splitting via non-VCHAR bytes in structured-fields string values. cow_http_struct_hd:escape_string/2 in cowlib only escapes \ and ", passing all other bytes through verbatim. This creates an encoder/decoder asymmetry: the matching parser accepts only printable ASCII (0x20–0x7E, excluding " and \), but the encoder emits any byte including CR and LF. An application that builds a structured HTTP header via cow_http_struct_hd:item/1 (or a higher-level wrapper such as cow_http_hd:wt_protocol/1) from attacker-controlled input can have \r\n injected into the serialized header value. Once on the wire, the injected CRLF terminates the current header and any following bytes are interpreted as a new header, enabling HTTP response splitting. This issue affects cowlib: from 2.9.0 onward.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:14 | erlang-cowboy | 2.16.1+dfsg-1 | DEBIAN-CVE-2026-43966 |
| Debian:12 | rabbitmq-server | no fix listed | DEBIAN-CVE-2026-43966 |
| Debian:13 | rabbitmq-server | no fix listed | DEBIAN-CVE-2026-43966 |
| Debian:14 | rabbitmq-server | no fix listed | DEBIAN-CVE-2026-43966 |
| Ubuntu:22.04:LTS | rabbitmq-server | no fix listed | UBUNTU-CVE-2026-43966 |
| Ubuntu:24.04:LTS | rabbitmq-server | no fix listed | UBUNTU-CVE-2026-43966 |
| Ubuntu:25.10 | rabbitmq-server | no fix listed | UBUNTU-CVE-2026-43966 |
| Ubuntu:26.04:LTS | rabbitmq-server | no fix listed | UBUNTU-CVE-2026-43966 |
Affected products (as reported)
Weakness: CWE-113 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
References
- cowboy: Add invalid_response_headers HTTP/1 option mitigation
- EEF CNA record for CVE-2026-43966 related, third-party-advisory
- OSV record EEF-CVE-2026-43966 related
- gun: Add invalid_request_headers request option mitigation
- Introducing commit a8b793d in ninenines/cowlib related
- Fix commit 4401b85 in ninenines/cowlib patch