CVE-2026-43971: Link Header Directive Smuggling via Unescaped target/rel/Attribute Keys in cow_link:link/1
Improper Encoding or Escaping of Output vulnerability in ninenines cowlib allows Link header directive smuggling via unescaped special characters in cowlink:link/1.
cowlink:dolink/1 in cowlib interpolates the target URI, rel value, and attribute keys directly into the serialized Link: header value without escaping or token-grammar validation. A > byte in target prematurely closes the URI slot, allowing an attacker to append additional link entries with attacker-chosen rel directives. A " or \ in rel escapes the quoted string and opens new parameters. Any byte — including whitespace, =, and " — in an attribute key is emitted verbatim. Because browsers act on Link: directives such as rel="preconnect", rel="preload", and rel="prerender", an attacker who can influence these fields in an application that round-trips parsed Link headers through cowlink:link/1 can force victim browsers to make out-of-band connections to attacker-controlled origins.
This issue affects cowlib: from 2.9.0 onward.
Affected Software
Event History
Frequently Asked Questions
What conditions must exist for an attacker to exploit this issue?
Applications are exposed when attacker-controlled values can reach the target URI, rel value, or attribute-key fields and the application parses and reserializes Link headers through cow_link:link/1. The practical browser impact described is the ability to cause victim browsers to make out-of-band connections to attacker-controlled origins through injected Link directives.
Which deployments are affected?
cowlib versions from 2.9.0 onward are affected. The provided information does not identify a fixed version or a configuration change that disables the vulnerable serialization behavior.
How can I determine whether my application is exposed?
Inspect code paths that round-trip parsed Link headers through cow_link:link/1 or cow_link:do_link/1, and trace whether untrusted input can influence target URIs, rel values, or attribute keys. Inputs containing > in a target, " or \ in a rel value, or special characters such as whitespace, =, or " in attribute keys indicate relevant injection opportunities.