EUVD-2026-29193
GHSA-g2wm-735q-3f56
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N reflects realistic network-reachable attack path via application input; AC:H captures the prerequisite that unsanitized user data must flow to cow_cookie:cookie/1; S:C because injected headers affect a downstream scoped system.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
5DescriptionCVE.org
Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows HTTP request splitting and cookie smuggling via unvalidated cookie name and value fields.
cow_cookie:cookie/1 in cowlib builds a client-side Cookie: request header from a list of name-value pairs without validating either field. An attacker who controls the cookie names or values passed to this function can inject ;, ,, CR, LF, or TAB characters into the serialized header. This enables two classes of attack: cookie smuggling within a single header (e.g. injecting "; admin=1" to introduce a phantom cookie that the receiving server treats as authentic) and HTTP request header splitting (injecting CRLF to append arbitrary headers or smuggle a complete second request against a shared upstream proxy). The decoder side (parse_cookie_name/1, parse_cookie_value/1) and setcookie/3 already validate and reject these characters; the encoder alone is missing the check.
This issue affects cowlib from 2.9.0.
AnalysisAI
CRLF injection in cowlib's cow_cookie:cookie/1 encoder allows an attacker who controls cookie name or value strings to inject semicolons, commas, CR, LF, or TAB characters into a serialized Cookie: request header, enabling cookie smuggling and HTTP request header splitting against downstream proxies or servers. Affected applications are those built on cowlib 2.9.0 and later that pass externally-influenced data directly to this function without prior sanitization - notably Cowboy-based Erlang web services acting as reverse proxies or API gateways. No public exploit has been identified and no active exploitation is confirmed; EPSS stands at 0.02% (6th percentile) and CISA KEV status is absent, consistent with SSVC exploitation: none.
Technical ContextAI
cowlib is a low-level Erlang HTTP/1.x and HTTP/2 parsing and serialization library, most prominently used by the Cowboy HTTP server and its ecosystem. CWE-93 (Improper Neutralization of CRLF Sequences) identifies the root cause: the cow_cookie:cookie/1 encoder concatenates user-supplied name-value pairs into a Cookie: request header using iolist construction without asserting that the inputs are free of forbidden characters - specifically semicolon, comma, CR (\r), LF (\n), VT (\013), FF (\014), and TAB. The decoder side (parse_cookie_name/1, parse_cookie_value/1) and the setcookie/3 response-cookie builder already enforce this validation via binary:match/2 guards, making the cookie/1 client-header encoder the sole unguarded path. The patch commit (177953dd51540da11090666c1f007214127a1144 in the erlef fork) mirrors the existing decoder validation directly into the encoder and also backfills missing guards for the Domain and Path attributes in setcookie/3's attributes/1 helper. CPE cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:* covers all versions from 2.9.0 per the advisory.
RemediationAI
The primary fix is to apply the upstream patch commit 177953dd51540da11090666c1f007214127a1144 from the erlef fork of cowlib (https://github.com/erlef/cowlib/commit/177953dd51540da11090666c1f007214127a1144); a separately tagged released version incorporating this commit is not independently confirmed from available data, so consumers should verify with the erlef maintainers or pin to a commit SHA past this point. As a compensating control where patching is not immediately feasible, applications should sanitize or reject cookie name and value strings containing CR (\r), LF (\n), semicolon, comma, VT (\013), FF (\014), or TAB characters before passing them to cow_cookie:cookie/1 - this mirrors exactly the validation the patch adds at the library level. This application-layer guard can be implemented without modifying cowlib but requires auditing all call sites that construct cookie lists from external input; missing a single call site leaves the gap open. Note that values produced by the existing decoder functions (parse_cookie_name/1, parse_cookie_value/1) are already validated and safe to re-encode; the risk is confined to application code that constructs cookie pairs independently from external data.
Remote denial of service in ninenines cowlib (the HTTP support library behind the Cowboy web server and Gun client) from
Unauthenticated remote denial of service in ninenines cowlib (versions 0.1.0 through 2.16.0) allows a single crafted SPD
Link header directive smuggling in ninenines cowlib (2.9.0+) enables attacker-controlled browsers to initiate out-of-ban
HTTP response splitting in ninenines cowlib allows network-accessible attackers to inject arbitrary HTTP headers when ap
CRLF injection in cowlib's SSE encoder allows an attacker who supplies field values - id, event, data, or comment - cont
Share
External POC / Exploit Code
Leaving vuln.today