EUVD-2026-60573
GHSA-gg23-fwhr-prjh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects AT:P precondition (app must round-trip attacker input through cow_link); S:C because victim browsers are the impacted subsequent system.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
1DescriptionCVE.org
Improper Encoding or Escaping of Output vulnerability in ninenines cowlib allows Link header directive smuggling via unescaped special characters in cow_link:link/1.
cow_link:do_link/1 in cowlib interpolates the target URI, rel value, and attribute keys directly into the serialized Link: header value without escaping or token-grammar validation. A > byte in target prematurely closes the URI slot, allowing an attacker to append additional link entries with attacker-chosen rel directives. A " or \ in rel escapes the quoted string and opens new parameters. Any byte - including whitespace, =, and " - in an attribute key is emitted verbatim. Because browsers act on Link: directives such as rel="preconnect", rel="preload", and rel="prerender", an attacker who can influence these fields in an application that round-trips parsed Link headers through cow_link:link/1 can force victim browsers to make out-of-band connections to attacker-controlled origins.
This issue affects cowlib: from 2.9.0 onward.
AnalysisAI
Link header directive smuggling in ninenines cowlib (2.9.0+) enables attacker-controlled browsers to initiate out-of-band connections to arbitrary origins. The cow_link:do_link/1 function emits target URI, rel values, and attribute keys verbatim into serialized Link headers - a '>' byte in the target prematurely terminates the URI angle-bracket slot, while '"' or '\' in rel breaks out of the quoted-string context, allowing injection of additional synthetic link directives. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two simultaneous application-level conditions: first, the target application must invoke cow_link:link/1 (or cow_link:do_link/1) to serialize Link headers that are sent to browser clients; second, at least one of the three interpolated fields - the target URI, the rel value, or an attribute key - must be directly or indirectly influenced by attacker-controlled input (e.g., a query parameter, request header, or database value that originated from external input). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is moderate and highly conditional. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch with a specific fixed version has been identified in the available data at time of analysis; the ERLEF advisory at https://cna.erlef.org/cves/CVE-2026-43971.html and OSV entry at https://osv.dev/vulnerability/EEF-CVE-2026-43971 should be monitored for an upstream fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote denial of service in ninenines cowlib (the HTTP support library behind the Cowboy web server and Gun client) from
Unauthenticated remote denial of service in ninenines cowlib (versions 0.1.0 through 2.16.0) allows a single crafted SPD
HTTP response splitting in ninenines cowlib allows network-accessible attackers to inject arbitrary HTTP headers when ap
CRLF injection in cowlib's SSE encoder allows an attacker who supplies field values - id, event, data, or comment - cont
CRLF injection in cowlib's cow_cookie:cookie/1 encoder allows an attacker who controls cookie name or value strings to i
Same weakness CWE-116 – Improper Encoding or Escaping of Output
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today