ZeroDay Findings
Sign inSign up

Findings

CVE-2026-43969

Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1

Published May 11, 2026 · updated Oct 9, 2026 · ninenines cowlib

## Summary Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows HTTP request splitting and cookie smuggling via unvalidated cookie name and value fields. in cowlib builds a client-side request header from a list of name-value pairs without validating either field. An attacker who controls the cookie names or values passed to this function can inject , , CR, LF, or TAB characters into the serialized header. This enables two classes of attack: cookie smuggling within a single header (e.g. injecting to introduce a phantom cookie that the receiving server treats as authentic) and HTTP request header splitting (injecting CRLF to append arbitrary headers or smuggle a complete second request against a shared upstream proxy). The decoder side ( , ) and already validate and reject these characters; the encoder alone is missing the check. This issue affects cowlib: from 2.9.0 before 2.21.0. ## Workarounds Validate inputs into to only include valid cookie name and value characters as defined in RFC 6265 Section 4.1.1 before passing them to the function. ## Configurations The application must pass attacker-controlled bytes as cookie names or values to . Applications that construct cookie lists exclusively from trusted, application-controlled values are not affected.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. May 11, 2026 · GitHub Advisory Database

    Detected

    ## Summary Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows HTTP request splitting and cookie smuggling via unvalidated cookie name and value fields. in cowlib builds a client-side request header from a list of name-value pairs without validating either field. An attacker who controls the cookie names or values passed to this function can inject

  2. Oct 9, 2026 · GitHub Advisory Database

    Fix available

    cowlib fixed in 2.21.0

  3. Oct 9, 2026 · GitHub Advisory Database

    Fix available

    cowlib fixed in 2.21.0

  4. Oct 9, 2026 · GitHub Advisory Database

    Updated

    ## Summary Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows HTTP request splitting and cookie smuggling via unvalidated cookie name and value fields. in cowlib builds a client-side request header from a list of name-value pairs without validating either field. An attacker who controls the cookie names or values passed to this function can inject

  5. Oct 9, 2026 · NIST NVD

    Updated

    Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows HTTP request splitting and cookie smuggling via unvalidated cookie name and value fields. cow_cookie:cookie/1 in cowlib builds a client-side Cookie: request header from a list of name-value pairs without validating either field. An attacker who controls the cookie names or values passed to this fu

Affected

  • Hex cowlib2.9.0 → 2.21.0
  • cpe ninenines/cowlibversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-43969

    Official CVE identifier

    cve.org
  • GitHub Advisory DatabasePackage advisoryGHSA-g2wm-735q-3f56

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • NIST NVDVulnerability recordCVE-2026-43969

    Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows HTTP request splitting and cookie smuggling via unvalidated cookie name and value fields. cow_cookie:cookie/1 in cowlib builds a client-side Cookie: request header from a list o

    nvd.nist.gov
  • OSV.devPackage advisoryEEF-CVE-2026-43969

    Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1

    osv.dev

References