CVE-2026-43966: HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2
HTTP Response Splitting via Non-VCHAR Bytes in cowhttpstructhd:escapestring/2
Other sources
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in ninenines cowlib allows HTTP response splitting via non-VCHAR bytes in structured-fields string values.
cowhttpstructhd:escapestring/2 in cowlib only escapes \ and ", passing all other bytes through verbatim. This creates an encoder/decoder asymmetry: the matching parser accepts only printable ASCII (0x20–0x7E, excluding " and \), but the encoder emits any byte including CR and LF. An application that builds a structured HTTP header via cowhttpstructhd:item/1 (or a higher-level wrapper such as cowhttphd:wtprotocol/1) from attacker-controlled input can have \r\n injected into the serialized header value. Once on the wire, the injected CRLF terminates the current header and any following bytes are interpreted as a new header, enabling HTTP response splitting.
This issue affects cowlib from 2.9.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.13.7-7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.13.7-8 - Upgrade
Upgrade
cowlibto a version that resolves this vulnerability.Fixed in 2.9.0 - Configuration
Modify/override cow_http_struct_hd:escape_string/2 so that structured-fields string values cannot contain CR (\r) or LF (\n); currently it only escapes backslash (\) and double-quote ("), passing other bytes through verbatim, which enables HTTP response splitting.
cow_http_struct_hd:escape_string/2 (cowlib) CRLF sanitization for structured-fields string values = Escape or remove CR (\r) and LF (\n) so they are not emitted verbatim
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43966?
CVE-2026-43966 has a medium severity rating of 6.3 according to the CVSS score.
How do I fix CVE-2026-43966?
To fix CVE-2026-43966, ensure that you update to the latest version of the cowlib library that addresses this vulnerability.
What kind of vulnerability is CVE-2026-43966?
CVE-2026-43966 is an HTTP Response Splitting vulnerability caused by improper neutralization of CRLF sequences in HTTP headers.
Which software is affected by CVE-2026-43966?
The CVE-2026-43966 vulnerability affects the hex/cowlib software library.
What can be exploited with CVE-2026-43966?
CVE-2026-43966 can be exploited to perform HTTP response splitting attacks through non-VCHAR bytes in structured-fields.