Vulnerability · CVE-2026-43969
Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1
Published May 11, 2026 · catalog updated Oct 9, 2026 · Cookie Request Header Injection
Check if you run it
No confirmed exploitation is on record for CVE-2026-43969. EPSS is 0.21%. Act only if a listed version of Cookie Request Header Injection is installed.
Gaps on this record
- The stored product name is a package slug. The name on this page is taken from the title (Cookie Request Header Injection).
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
- Severity
- Low2.1
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- 0.21%
- Remediation
- Advisory link
- Affected products
- Hex cowlib · cpe ninenines/cowlib
## Summary Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows HTTP request splitting and cookie smuggling via unvalidated cookie name and value fields. in cowlib builds a client-side request header from a list of name-value pairs without validating either field. An attacker who controls the cookie names or values passed to this function can inject , , CR, LF, or TAB characters into the serialized header. This enables two classes of attack: cookie smuggling within a single header (e.g. injecting to introduce a phantom cookie that the receiving server treats as authentic) and HTTP request header splitting (injecting CRLF to append arbitrary headers or smuggle a complete second request against a shared upstream proxy). The decoder side ( , ) and already validate and reject these characters; the encoder alone is missing the check. This issue affects cowlib: from 2.9.0 before 2.21.0. ## Workarounds Validate inputs into to only include valid cookie name and value characters as defined in RFC 6265 Section 4.1.1 before passing them to the function. ## Configurations The application must pass attacker-controlled bytes as cookie names or values to . Applications that construct cookie lists exclusively from trusted, application-controlled values are not affected.
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- Hex cowlib2.9.0 → 2.21.0
- cpe ninenines/cowlibversion unspecified
How to fix CVE-2026-43969
Recommended remediation
A patch or advisory reference is linked. Open the original publisher for availability by product version.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
No confirmed exploitation is on record for CVE-2026-43969. EPSS is 0.21%. Act only if a listed version of Cookie Request Header Injection is installed.
Which versions are affected?
Compare what you have installed with 2.9.0 → 2.21.0. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
CWE-93. EPSS 0.21%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
May 11, 2026 · GitHub Advisory Database
Detected
## Summary Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows HTTP request splitting and cookie smuggling via unvalidated cookie name and value fields. in cowlib builds a client-side request header from a list of name-value pairs without validating either field. An attacker who controls the cookie names or values passed to this function can inject
Oct 9, 2026 · GitHub Advisory Database
Fix available
cowlib fixed in 2.21.0
Oct 9, 2026 · GitHub Advisory Database
Fix available
cowlib fixed in 2.21.0
Oct 9, 2026 · GitHub Advisory Database
Updated
## Summary Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows HTTP request splitting and cookie smuggling via unvalidated cookie name and value fields. in cowlib builds a client-side request header from a list of name-value pairs without validating either field. An attacker who controls the cookie names or values passed to this function can inject
Oct 9, 2026 · NIST NVD
Updated
Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows HTTP request splitting and cookie smuggling via unvalidated cookie name and value fields. cow_cookie:cookie/1 in cowlib builds a client-side Cookie: request header from a list of name-value pairs without validating either field. An attacker who controls the cookie names or values passed to this fu
Sources
- CVE.orgVulnerability recordCVE-2026-43969
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-43969
30-day exploitation probability 0.2%
first.org - GitHub Advisory DatabasePackage advisoryGHSA-g2wm-735q-3f56
GitHub Advisory Database record mirrored by OSV.
github.com - NIST NVDVulnerability recordCVE-2026-43969
Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows HTTP request splitting and cookie smuggling via unvalidated cookie name and value fields. cow_cookie:cookie/1 in cowlib builds a client-side Cookie: request header from a list o
nvd.nist.gov - OpenSSF OSV / OSV ScannerPackage advisoryEEF-CVE-2026-43969
Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1
osv.dev
References
Freshness
Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.