EUVD-2026-29192
GHSA-hv23-4qp7-8c8r
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no auth per source vector PR:N; scope changes to browser client (S:C); only stream integrity affected (I:L), no confidentiality or availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows SSE event splitting and injection via unvalidated field values.
cow_sse:event/1 in cowlib guards the id and event fields against \n but not against bare \r, and the internal prefix_lines/2 function used for data and comment fields splits only on \n. Because the SSE specification requires decoders to treat \r\n, \r, and \n as equivalent line terminators, an attacker who controls any of these fields can inject additional SSE lines and forge a complete event with an arbitrary event type and data payload on the receiving end. In typical deployments where browser EventSource clients or other SSE consumers dispatch on event.type and render event.data, this enables event splitting, client-side logic manipulation, and stored-XSS-equivalent behaviour when event data is inserted into the DOM.
This issue affects cowlib from 2.6.0.
AnalysisAI
CRLF injection in cowlib's SSE encoder allows an attacker who supplies field values - id, event, data, or comment - containing bare carriage-return (\r) characters to split and forge arbitrary SSE events on receiving clients. Affected are all cowlib deployments from version 2.6.0 used to stream SSE to browser EventSource clients or other SSE consumers that dispatch on event.type or render event.data into the DOM, where the impact is equivalent to stored XSS. No active exploitation is confirmed (not in CISA KEV), EPSS is 0.04% (14th percentile), and SSVC rates automatable as 'no', indicating this is a targeted rather than mass-exploitable flaw; however, applications that echo user-controlled data through SSE fields face meaningful client-side integrity risk.
Technical ContextAI
cowlib (CPE: cpe:2.3:a:ninenines:cowlib) is an Erlang/OTP HTTP utility library that underpins the Cowboy HTTP server, providing parsers and encoders for HTTP/1.1, HTTP/2, WebSocket, and Server-Sent Events. The vulnerable code path is cow_sse:event/1 in src/cow_sse.erl, which constructs SSE frames. Prior to the fix, field validation for id and event used binary:match(Bin, <<"\n">>) - checking only for LF - while the internal prefix_lines/2 helper split data and comment fields on \n alone. CWE-93 (Improper Neutralization of CRLF Sequences) describes precisely this pattern: incomplete line-terminator sanitization that leaves CR (\r) as an unguarded injection vector. The SSE specification (HTML Living Standard) mandates that decoders treat \r\n, \r, and \n as equivalent line terminators, so a bare \r in an encoded field is indistinguishable from a real field boundary on the client. The fix (commit 6165fc40) expands all binary:match and binary:split calls to cover [<<"\r\n">>, <<"\r">>, <<"\n">>], closing the gap.
RemediationAI
Upstream fix is available as commit 6165fc40efa159ba1cceee7e7981e790acba5d9c in the ninenines/cowlib GitHub repository (https://github.com/ninenines/cowlib/commit/6165fc40efa159ba1cceee7e7981e790acba5d9c). A released tagged version containing this fix has not been independently confirmed from the available references - verify the patched release tag in the ninenines/cowlib repository and update your rebar3 or mix dependency accordingly before deploying. As a compensating control where immediate upgrade is not feasible, applications should sanitize all user-controlled input before passing it to cow_sse:event/1 by stripping or rejecting any \r characters alongside \n from id, event, data, and comment field values at the application layer; this adds defence in depth but introduces a maintenance burden and must be applied consistently at every SSE emission call site.
Remote denial of service in ninenines cowlib (the HTTP support library behind the Cowboy web server and Gun client) from
Unauthenticated remote denial of service in ninenines cowlib (versions 0.1.0 through 2.16.0) allows a single crafted SPD
Link header directive smuggling in ninenines cowlib (2.9.0+) enables attacker-controlled browsers to initiate out-of-ban
HTTP response splitting in ninenines cowlib allows network-accessible attackers to inject arbitrary HTTP headers when ap
CRLF injection in cowlib's cow_cookie:cookie/1 encoder allows an attacker who controls cookie name or value strings to i
Share
External POC / Exploit Code
Leaving vuln.today