Vulnerability in Ninenines Cowlib

CVE-2026-43966

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in ninenines cowlib allows HTTP response splitting via non-VCHAR bytes in structured-fields string values. cow_http_struct_hd:esca…

EPSS: 0.003 (23.5th percentile) — read the EPSS interpretation.

Affected products

Ninenines Cowlib — versions 2.9.0, a8b793db3d6ffe91d62f81baf41b1dab4cd78fb6

Weakness classification (CWE)

CWE-113 — HTTP Response Splitting

References

6b3ad84c-e1a6-4bf7-a703-f496b71e49db (related, third-party-advisory)
6b3ad84c-e1a6-4bf7-a703-f496b71e49db (mitigation)
6b3ad84c-e1a6-4bf7-a703-f496b71e49db (mitigation)
6b3ad84c-e1a6-4bf7-a703-f496b71e49db (related)