Answer in brief
CVE-2026-43971 records a Medium severity (CVSS 6.3) vulnerability in Link Header Directive Smuggling via Unescaped target/rel/Attribute Keys in cow_link:link/1. The current sources do not mark it as known exploited. The current feed maps ninenines/cowlib (generic), ninenines/cowlib (generic), ninenines/cowlib (generic), ninenines/cowlib (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps ninenines/cowlib (generic), ninenines/cowlib (generic), ninenines/cowlib (generic), ninenines/cowlib (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| ninenines/cowlibgeneric | >=2.9.0 <* | * |
| ninenines/cowlibgeneric | >=485d58dfa91b91d98135dc95e5615f421715dae5 <* | * |
| ninenines/cowlibgeneric | >=485d58dfa91b91d98135dc95e5615f421715dae5 <89da27ee4c241f5d649ba7d9b7f2188918af6cea | 89da27ee4c241f5d649ba7d9b7f2188918af6cea |
| ninenines/cowlibgeneric | >=2.9.0 <2.20.0 | 2.20.0 |
Published upstream
Aug 18, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 18, 2026
Improper Encoding or Escaping of Output vulnerability in ninenines cowlib allows Link header directive smuggling via unescaped special characters in cow_link:link/1. cow_link:do_link/1 in cowlib interpolates the target URI, rel value, and attribute keys directly into the serialized Link: header value without escaping or token-grammar validation. A > byte in target prematurely closes the URI slot, allowing an attacker to append additional link entries with attacker-chosen rel directives. A " or \ in rel escapes the quoted string and opens new parameters. Any byte — including whitespace, =, and " — in an attribute key is emitted verbatim. Because browsers act on Link: directives such as rel="preconnect", rel="preload", and rel="prerender", an attacker who can influence these fields in an application that round-trips parsed Link headers through cow_link:link/1 can force victim browsers to make out-of-band connections to attacker-controlled origins. This issue affects cowlib: from 2.9.0 before 2.20.0.
Quoted source text, attributed separately from HOL analysis.