Answer in brief
CVE-2026-43969 records a Low severity vulnerability in Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1. The current sources do not mark it as known exploited. The current feed maps cowlib (erlang), ninenines/cowlib (generic), ninenines/cowlib (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps cowlib (erlang), ninenines/cowlib (generic), ninenines/cowlib (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| cowliberlang | >=2.9.0,<=2.16.1 | Not reported |
| ninenines/cowlibgeneric | >=2.9.0 <* | * |
| ninenines/cowlibgeneric | >=f017f8a0ecbffd5033d9ab49bf180186f7a523a7 <* | * |
Published upstream
May 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 18, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 11, 2026
Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows HTTP request splitting and cookie smuggling via unvalidated cookie name and value fields. cow_cookie:cookie/1 in cowlib builds a client-side Cookie: request header from a list of name-value pairs without validating either field. An attacker who controls the cookie names or values passed to this function can inject ;, ,, CR, LF, or TAB characters into the serialized header. This enables two classes of attack: cookie smuggling within a single header (e.g. injecting ; admin=1 to introduce a phantom cookie that the receiving server treats as authentic) and HTTP request header splitting (injecting CRLF to append arbitrary headers or smuggle a complete second request against a shared upstream proxy). The decoder side (parse_cookie_name/1, parse_cookie_value/1) and setcookie/3 already validate and reject these characters; the encoder alone is missing the check. This issue affects cowlib: from 2.9.0 onward.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-43969 records a Low severity vulnerability in Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1. The current sources do not mark it as known exploited. The current feed maps cowlib (erlang), ninenines/cowlib (generic), ninenines/cowlib (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps cowlib (erlang), ninenines/cowlib (generic), ninenines/cowlib (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| cowliberlang | >=2.9.0,<=2.16.1 | Not reported |
| ninenines/cowlibgeneric | >=2.9.0 <* | * |
| ninenines/cowlibgeneric | >=f017f8a0ecbffd5033d9ab49bf180186f7a523a7 <* | * |
Published upstream
May 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 18, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 11, 2026
Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows HTTP request splitting and cookie smuggling via unvalidated cookie name and value fields. cow_cookie:cookie/1 in cowlib builds a client-side Cookie: request header from a list of name-value pairs without validating either field. An attacker who controls the cookie names or values passed to this function can inject ;, ,, CR, LF, or TAB characters into the serialized header. This enables two classes of attack: cookie smuggling within a single header (e.g. injecting ; admin=1 to introduce a phantom cookie that the receiving server treats as authentic) and HTTP request header splitting (injecting CRLF to append arbitrary headers or smuggle a complete second request against a shared upstream proxy). The decoder side (parse_cookie_name/1, parse_cookie_value/1) and setcookie/3 already validate and reject these characters; the encoder alone is missing the check. This issue affects cowlib: from 2.9.0 onward.
Quoted source text, attributed separately from HOL analysis.