COWBOY · CVE-2026-43966 · Package
FIX → 2.16.0 · 2.4.0
The cowlib library, used by Erlang web servers cowboy and gun, fails to escape carriage return and line feed bytes when encoding structured HTTP header string values. An attacker who controls part of a header value can inject a line break and add arbitrary headers or a second response.
first public Jun 8, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Exposure requires an application built on cowboy or gun that passes attacker-controlled data into structured header encoding through cow_http_struct_hd:item/1 or cow_http_hd:wt_protocol/1. Applications that only use fixed header values or do not build structured headers from user input are not reachable through this path.
Not affected if fixed-header-values, no-user-input-in-headers
Who cares cowboy, cowlib, erlang, gun, hex
cowboy or gun (rebar.lock, mix.lock, or rebar3 tree) and read the locked version.Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in ninenines cowlib allows HTTP response splitting via non-VCHAR bytes in structured-fields string values.
cow_http_struct_hd:escape_string/2 in cowlib only escapes \ and ", passing all other bytes through verbatim. This creates an encoder/decoder asymmetry: the matching parser accepts only printable ASCII (0x20–0x7E, excluding " and ), but the encoder emits any byte including CR and LF. An application that builds a structured HTTP header via cow_http_struct_hd:item/1 (or a higher-level wrapper such as cow_http_hd:wt_protocol/1) from attacker-controlled input can have \r\n injected into the serialized header value. Once on the wire, the injected CRLF terminates the current header and any following bytes are interpreted as a new header, enabling HTTP response splitting.
This issue affects cowlib: from 2.9.0 before 2.22.0.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
cow_http_struct_hd:item/1cow_http_hd:wt_protocol/1Upgrade to 2.16.0 · 2.4.0
cowboy moves to 2.16.0gun moves to 2.4.0This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.