---
id: "CVE-2026-43966"
page: "https://infrastack.ai/live/CVE-2026-43966"
kind: "vulnerability"
aliases: ["CVE-2026-43966", "GHSA-w4f7-4cxr-rv3c"]
title: "cowboy and gun affected by an HTTP Request/Response Splitting vulnerability"
severity: "medium"
cvss: 6.3
epss: 0.00259
exploited: false
status: "open"
category: "package"
products: [{"name": "cowboy", "fixed": ["2.16.0"], "affected": "< 2.16.0", "ecosystem": "hex"}, {"name": "gun", "fixed": ["2.4.0"], "affected": "< 2.4.0", "ecosystem": "hex"}, {"name": "ninenines cowlib", "fixed": ["2.16.0"], "affected": ">= 2.9.0, < 2.16.0", "ecosystem": "vendor"}]
ecosystems: ["hex", "vendor"]
tags: ["cowboy", "cowlib", "cwe-113", "erlang", "gun", "hex", "package"]
not_affected_if: ["fixed-header-values", "no-user-input-in-headers"]
published_at: "2026-06-08T17:16:43+00:00"
first_seen_at: "2026-11-12T16:42:18+00:00"
updated_at: "2026-11-12T17:09:44+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-w4f7-4cxr-rv3c", "first_seen_at": "2026-11-12T16:42:18+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43966", "first_seen_at": "2026-11-12T17:09:44+00:00"}]
exploit_sources: [{"type": "epss", "score": 0.00259, "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-43966"}]
---

# cowboy and gun affected by an HTTP Request/Response Splitting vulnerability

Link for people: https://infrastack.ai/live/CVE-2026-43966 (this .md is for agents)

The cowlib library, used by Erlang web servers cowboy and gun, fails to escape carriage return and line feed bytes when encoding structured HTTP header string values. An attacker who controls part of a header value can inject a line break and add arbitrary headers or a second response.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- hex:cowboy affected < 2.16.0 fixed 2.16.0
- hex:gun affected < 2.4.0 fixed 2.4.0
- vendor:ninenines cowlib affected >= 2.9.0, < 2.16.0 fixed 2.16.0

## How to check

- Check whether the project depends on `cowboy` or `gun` (`rebar.lock`, `mix.lock`, or `rebar3 tree`) and read the locked version.
- Check whether application code calls `cow_http_struct_hd:item/1` or `cow_http_hd:wt_protocol/1` with user-supplied input.

## Fix

- `cowboy` moves to `2.16.0`
- `gun` moves to `2.4.0`

## Timeline

- 2026-11-12T16:42:18+00:00 ghsa https://github.com/advisories/GHSA-w4f7-4cxr-rv3c
- 2026-11-12T17:09:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-43966

## Documents

- [advisory] Third-party advisory: osv.dev https://osv.dev/vulnerability/EEF-CVE-2026-43966
- [advisory] Third-party advisory: cna.erlef.org https://cna.erlef.org/cves/CVE-2026-43966.html
- [fix] Patch: github.com https://github.com/ninenines/cowlib/commit/4401b858f2229abb3ea115c60924f6c77e5f8aa3
- [fix] Patch: github.com https://github.com/ninenines/cowlib/commit/a8b793db3d6ffe91d62f81baf41b1dab4cd78fb6
- [fix] Patch: github.com https://github.com/ninenines/cowlib/pull/163#issuecomment-4952645232
- [fix] Patch: github.com https://github.com/ninenines/cowlib/pull/166#issuecomment-5067554701
- [fix] Patch: github.com https://github.com/ninenines/cowboy/commit/f77cb9b5e730e300fffb551db1ba5d1c4ed878ef
- [fix] Patch: github.com https://github.com/ninenines/gun/commit/4f35609eb37109b106a863fc9ba83d7ee64e3e42

## From the sources

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in ninenines cowlib allows HTTP response splitting via non-VCHAR bytes in structured-fields string values.

cow_http_struct_hd:escape_string/2 in cowlib only escapes \ and ", passing all other bytes through verbatim. This creates an encoder/decoder asymmetry: the matching parser accepts only printable ASCII (0x20–0x7E, excluding " and \), but the encoder emits any byte including CR and LF. An application that builds a structured HTTP header via cow_http_struct_hd:item/1 (or a higher-level wrapper such as cow_http_hd:wt_protocol/1) from attacker-controlled input can have \r\n injected into the serialized header value. Once on the wire, the injected CRLF terminates the current header and any following bytes are interpreted as a new header, enabling HTTP response splitting.

This issue affects cowlib: from 2.9.0 before 2.22.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_