Vulnerability-Lookup

CVE-2026-43966 (GCVE-0-2026-43966)

Vulnerability from cvelistv5 – Published: 2026-06-08 16:34 – Updated: 2026-11-09 15:27

Title

HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2

Summary

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in ninenines cowlib allows HTTP response splitting via non-VCHAR bytes in structured-fields string values. cow_http_struct_hd:escape_string/2 in cowlib only escapes \ and ", passing all other bytes through verbatim. This creates an encoder/decoder asymmetry: the matching parser accepts only printable ASCII (0x20–0x7E, excluding " and \), but the encoder emits any byte including CR and LF. An application that builds a structured HTTP header via cow_http_struct_hd:item/1 (or a higher-level wrapper such as cow_http_hd:wt_protocol/1) from attacker-controlled input can have \r\n injected into the serialized header value. Once on the wire, the injected CRLF terminates the current header and any following bytes are interpreted as a new header, enabling HTTP response splitting. This issue affects cowlib: from 2.9.0 before 2.22.0.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-08 18:37 UTC

CWE

CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers

Assigner

EEF CNA under the mitre root

CNA scorecard A 97/100 over 352 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/ninenines/cowboy/commit/f77cb9…	mitigation
https://cna.erlef.org/cves/CVE-2026-43966.html	relatedthird-party-advisory
https://osv.dev/vulnerability/EEF-CVE-2026-43966	related
https://github.com/ninenines/gun/commit/4f35609eb…	mitigation
https://github.com/ninenines/cowlib/commit/a8b793…	related
https://github.com/ninenines/cowlib/commit/4401b8…	patch

Impacted products

2 products

Vendor	Product	Version	CPE status
ninenines	cowlib	Affected: 2.9.0 , < 2.22.0 (semver) cpe:2.3:a:ninenines:cowlib::::::::
ninenines	cowlib	Affected: a8b793db3d6ffe91d62f81baf41b1dab4cd78fb6 , < 4401b858f2229abb3ea115c60924f6c77e5f8aa3 (git) cpe:2.3:a:ninenines:cowlib::::::::

Date Public

2026-10-14 09:20

Credits

Peter Ullrich Loïc Hoguin Jonatan Männchen / EEF

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-43966",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-08T18:37:59.853576Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-08T18:38:08.160Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "cow_http_struct_hd"
          ],
          "packageName": "cowlib",
          "packageURL": "pkg:hex/cowlib",
          "product": "cowlib",
          "programFiles": [
            "src/cow_http_struct_hd.erl"
          ],
          "programRoutines": [
            {
              "name": "cow_http_struct_hd:escape_string/2"
            },
            {
              "name": "cow_http_struct_hd:bare_item/1"
            }
          ],
          "repo": "https://github.com/ninenines/cowlib",
          "vendor": "ninenines",
          "versions": [
            {
              "lessThan": "2.22.0",
              "status": "affected",
              "version": "2.9.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "cow_http_struct_hd"
          ],
          "packageName": "ninenines/cowlib",
          "packageURL": "pkg:github/ninenines/cowlib",
          "product": "cowlib",
          "programFiles": [
            "src/cow_http_struct_hd.erl"
          ],
          "programRoutines": [
            {
              "name": "cow_http_struct_hd:escape_string/2"
            },
            {
              "name": "cow_http_struct_hd:bare_item/1"
            }
          ],
          "repo": "https://github.com/ninenines/cowlib",
          "vendor": "ninenines",
          "versions": [
            {
              "lessThan": "4401b858f2229abb3ea115c60924f6c77e5f8aa3",
              "status": "affected",
              "version": "a8b793db3d6ffe91d62f81baf41b1dab4cd78fb6",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe application must pass attacker-controlled data as a string value into \u003ccode\u003ecow_http_struct_hd:item/1\u003c/code\u003e (or a wrapper that delegates to it). Applications that construct structured-fields header values exclusively from trusted, application-controlled values are not affected.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "The application must pass attacker-controlled data as a string value into `cow_http_struct_hd:item/1` (or a wrapper that delegates to it). Applications that construct structured-fields header values exclusively from trusted, application-controlled values are not affected."
            }
          ],
          "value": "The application must pass attacker-controlled data as a string value into cow_http_struct_hd:item/1 (or a wrapper that delegates to it). Applications that construct structured-fields header values exclusively from trusted, application-controlled values are not affected."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.22.0",
                  "versionStartIncluding": "2.9.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Lo\u00efc Hoguin"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "datePublic": "2026-10-14T09:20:41.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027) vulnerability in ninenines cowlib allows HTTP response splitting via non-VCHAR bytes in structured-fields string values.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003ecow_http_struct_hd:escape_string/2\u003c/code\u003e in cowlib only escapes \u003ccode\u003e\\\u003c/code\u003e and \u003ccode\u003e\"\u003c/code\u003e, passing all other bytes through verbatim. This creates an encoder/decoder asymmetry: the matching parser accepts only printable ASCII (0x20\u20130x7E, excluding \u003ccode\u003e\"\u003c/code\u003e and \u003ccode\u003e\\\u003c/code\u003e), but the encoder emits any byte including CR and LF. An application that builds a structured HTTP header via \u003ccode\u003ecow_http_struct_hd:item/1\u003c/code\u003e (or a higher-level wrapper such as \u003ccode\u003ecow_http_hd:wt_protocol/1\u003c/code\u003e) from attacker-controlled input can have \u003ccode\u003e\\r\\n\u003c/code\u003e injected into the serialized header value. Once on the wire, the injected CRLF terminates the current header and any following bytes are interpreted as a new header, enabling HTTP response splitting.\u003c/p\u003e\n\u003cp\u003eThis issue affects cowlib: from 2.9.0 before 2.22.0.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027) vulnerability in ninenines cowlib allows HTTP response splitting via non-VCHAR bytes in structured-fields string values.\n\n`cow_http_struct_hd:escape_string/2` in cowlib only escapes `\\` and `\"`, passing all other bytes through verbatim. This creates an encoder/decoder asymmetry: the matching parser accepts only printable ASCII (0x20\u20130x7E, excluding `\"` and `\\`), but the encoder emits any byte including CR and LF. An application that builds a structured HTTP header via `cow_http_struct_hd:item/1` (or a higher-level wrapper such as `cow_http_hd:wt_protocol/1`) from attacker-controlled input can have `\\r\\n` injected into the serialized header value. Once on the wire, the injected CRLF terminates the current header and any following bytes are interpreted as a new header, enabling HTTP response splitting.\n\nThis issue affects cowlib: from 2.9.0 before 2.22.0."
            }
          ],
          "value": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027) vulnerability in ninenines cowlib allows HTTP response splitting via non-VCHAR bytes in structured-fields string values.\n\ncow_http_struct_hd:escape_string/2 in cowlib only escapes \\ and \", passing all other bytes through verbatim. This creates an encoder/decoder asymmetry: the matching parser accepts only printable ASCII (0x20\u20130x7E, excluding \" and \\), but the encoder emits any byte including CR and LF. An application that builds a structured HTTP header via cow_http_struct_hd:item/1 (or a higher-level wrapper such as cow_http_hd:wt_protocol/1) from attacker-controlled input can have \\r\\n injected into the serialized header value. Once on the wire, the injected CRLF terminates the current header and any following bytes are interpreted as a new header, enabling HTTP response splitting.\n\nThis issue affects cowlib: from 2.9.0 before 2.22.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-34",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-34 HTTP Response Splitting"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-113",
              "description": "CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T15:27:41.487Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "name": "cowboy: Add invalid_response_headers HTTP/1 option",
          "tags": [
            "mitigation"
          ],
          "url": "https://github.com/ninenines/cowboy/commit/f77cb9b5e730e300fffb551db1ba5d1c4ed878ef"
        },
        {
          "name": "EEF CNA record for CVE-2026-43966",
          "tags": [
            "related",
            "third-party-advisory"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-43966.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-43966",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-43966"
        },
        {
          "name": "gun: Add invalid_request_headers request option",
          "tags": [
            "mitigation"
          ],
          "url": "https://github.com/ninenines/gun/commit/4f35609eb37109b106a863fc9ba83d7ee64e3e42"
        },
        {
          "name": "Introducing commit a8b793d in ninenines/cowlib",
          "tags": [
            "related"
          ],
          "url": "https://github.com/ninenines/cowlib/commit/a8b793db3d6ffe91d62f81baf41b1dab4cd78fb6"
        },
        {
          "name": "Fix commit 4401b85 in ninenines/cowlib",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ninenines/cowlib/commit/4401b858f2229abb3ea115c60924f6c77e5f8aa3"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eValidate all values passed into structured-fields header builders (directly via \u003ccode\u003ecow_http_struct_hd:item/1\u003c/code\u003e or indirectly via higher-level wrappers) before calling the encoder. Reject any value that is not from a trusted, application-controlled source or that contains CR (\u003ccode\u003e\\r\u003c/code\u003e) or LF (\u003ccode\u003e\\n\u003c/code\u003e) bytes.\u003c/p\u003e\n\u003cp\u003eApplications using cowboy 2.16.0 or later are protected on the server side by the \u003ccode\u003einvalid_response_headers\u003c/code\u003e option (defaults to \u003ccode\u003eerror_terminate\u003c/code\u003e), which rejects any outgoing response header value containing CR or LF before it reaches the wire. Applications using gun 2.4.0 or later are protected on the client side by the \u003ccode\u003einvalid_request_headers\u003c/code\u003e request option (defaults to \u003ccode\u003eraise\u003c/code\u003e), which raises an exception when an outgoing request header value contains CR or LF.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Validate all values passed into structured-fields header builders (directly via `cow_http_struct_hd:item/1` or indirectly via higher-level wrappers) before calling the encoder. Reject any value that is not from a trusted, application-controlled source or that contains CR (`\\r`) or LF (`\\n`) bytes.\n\nApplications using cowboy 2.16.0 or later are protected on the server side by the `invalid_response_headers` option (defaults to `error_terminate`), which rejects any outgoing response header value containing CR or LF before it reaches the wire. Applications using gun 2.4.0 or later are protected on the client side by the `invalid_request_headers` request option (defaults to `raise`), which raises an exception when an outgoing request header value contains CR or LF."
            }
          ],
          "value": "Validate all values passed into structured-fields header builders (directly via cow_http_struct_hd:item/1 or indirectly via higher-level wrappers) before calling the encoder. Reject any value that is not from a trusted, application-controlled source or that contains CR (\\r) or LF (\\n) bytes.\n\nApplications using cowboy 2.16.0 or later are protected on the server side by the invalid_response_headers option (defaults to error_terminate), which rejects any outgoing response header value containing CR or LF before it reaches the wire. Applications using gun 2.4.0 or later are protected on the client side by the invalid_request_headers request option (defaults to raise), which raises an exception when an outgoing request header value contains CR or LF."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-43966",
    "datePublished": "2026-06-08T16:34:33.364Z",
    "dateReserved": "2026-05-04T18:23:25.573Z",
    "dateUpdated": "2026-11-09T15:27:41.487Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43966",
      "date": "2026-11-10",
      "epss": "0.00259",
      "percentile": "0.17663"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-13T00:05:43.000Z",
      "cve": "CVE-2026-43966",
      "id": "msrc_CVE-2026-43966",
      "initial_release_date": "2026-06-19T01:01:53.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-43966.json",
      "version": "4"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://repo.hex.pm",
                "cpes": [
                  "cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "modules": [
                  "cow_http_struct_hd"
                ],
                "packageName": "cowlib",
                "packageURL": "pkg:hex/cowlib",
                "product": "cowlib",
                "programFiles": [
                  "src/cow_http_struct_hd.erl"
                ],
                "programRoutines": [
                  {
                    "name": "cow_http_struct_hd:escape_string/2"
                  },
                  {
                    "name": "cow_http_struct_hd:bare_item/1"
                  }
                ],
                "repo": "https://github.com/ninenines/cowlib",
                "vendor": "ninenines",
                "versions": [
                  {
                    "lessThan": "2.22.0",
                    "status": "affected",
                    "version": "2.9.0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "collectionURL": "https://github.com",
                "cpes": [
                  "cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "modules": [
                  "cow_http_struct_hd"
                ],
                "packageName": "ninenines/cowlib",
                "packageURL": "pkg:github/ninenines/cowlib",
                "product": "cowlib",
                "programFiles": [
                  "src/cow_http_struct_hd.erl"
                ],
                "programRoutines": [
                  {
                    "name": "cow_http_struct_hd:escape_string/2"
                  },
                  {
                    "name": "cow_http_struct_hd:bare_item/1"
                  }
                ],
                "repo": "https://github.com/ninenines/cowlib",
                "vendor": "ninenines",
                "versions": [
                  {
                    "lessThan": "4401b858f2229abb3ea115c60924f6c77e5f8aa3",
                    "status": "affected",
                    "version": "a8b793db3d6ffe91d62f81baf41b1dab4cd78fb6",
                    "versionType": "git"
                  }
                ]
              }
            ],
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A583B546-6841-4B45-9E4D-67B1926640AB",
                    "versionEndExcluding": "2.16.0",
                    "versionStartIncluding": "2.9.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027) vulnerability in ninenines cowlib allows HTTP response splitting via non-VCHAR bytes in structured-fields string values.\n\ncow_http_struct_hd:escape_string/2 in cowlib only escapes \\ and \", passing all other bytes through verbatim. This creates an encoder/decoder asymmetry: the matching parser accepts only printable ASCII (0x20\u20130x7E, excluding \" and \\), but the encoder emits any byte including CR and LF. An application that builds a structured HTTP header via cow_http_struct_hd:item/1 (or a higher-level wrapper such as cow_http_hd:wt_protocol/1) from attacker-controlled input can have \\r\\n injected into the serialized header value. Once on the wire, the injected CRLF terminates the current header and any following bytes are interpreted as a new header, enabling HTTP response splitting.\n\nThis issue affects cowlib: from 2.9.0 before 2.22.0."
          },
          {
            "lang": "es",
            "value": "La vulnerabilidad de Neutralizaci\u00f3n Incorrecta de Secuencias CRLF en Encabezados HTTP (\u0027Divisi\u00f3n de Solicitud/Respuesta HTTP\u0027) en ninenines cowlib permite la divisi\u00f3n de respuesta HTTP a trav\u00e9s de bytes no VCHAR en valores de cadena de campos estructurados.\n\ncow_http_struct_hd:escape_string/2 en cowlib solo escapa \\ y \", pasando todos los dem\u00e1s bytes textualmente. Esto crea una asimetr\u00eda de codificador/decodificador: el analizador coincidente acepta solo ASCII imprimible (0x20-0x7E, excluyendo \" y \\), pero el codificador emite cualquier byte, incluidos CR y LF. Una aplicaci\u00f3n que construye un encabezado HTTP estructurado a trav\u00e9s de cow_http_struct_hd:item/1 (o un envoltorio de nivel superior como cow_http_hd:wt_protocol/1) desde una entrada controlada por el atacante puede tener \\r\\n inyectado en el valor del encabezado serializado. Una vez en la red, el CRLF inyectado termina el encabezado actual y cualquier byte siguiente se interpreta como un nuevo encabezado, lo que permite la divisi\u00f3n de respuesta HTTP.\n\nEste problema afecta a cowlib desde la versi\u00f3n 2.9.0."
          }
        ],
        "id": "CVE-2026-43966",
        "lastModified": "2026-11-09T16:17:33.340",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 1.4,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 6.3,
                "baseSeverity": "MEDIUM",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "LOW",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-43966",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-08T18:37:59.853576Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-06-08T17:16:43.447",
        "references": [
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://cna.erlef.org/cves/CVE-2026-43966.html"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/ninenines/cowboy/commit/f77cb9b5e730e300fffb551db1ba5d1c4ed878ef"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://github.com/ninenines/cowlib/commit/4401b858f2229abb3ea115c60924f6c77e5f8aa3"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://github.com/ninenines/cowlib/commit/a8b793db3d6ffe91d62f81baf41b1dab4cd78fb6"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/ninenines/gun/commit/4f35609eb37109b106a863fc9ba83d7ee64e3e42"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://osv.dev/vulnerability/EEF-CVE-2026-43966"
          }
        ],
        "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-113"
              }
            ],
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-06-09T20:59:32+00:00",
      "cve": "CVE-2026-43966",
      "id": "CVE-2026-43966",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43966.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-43966",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-08T18:37:59.853576Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-08T18:38:04.203Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://repo.hex.pm",
              "cpes": [
                "cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "modules": [
                "cow_http_struct_hd"
              ],
              "packageName": "cowlib",
              "packageURL": "pkg:hex/cowlib",
              "product": "cowlib",
              "programFiles": [
                "src/cow_http_struct_hd.erl"
              ],
              "programRoutines": [
                {
                  "name": "cow_http_struct_hd:escape_string/2"
                },
                {
                  "name": "cow_http_struct_hd:bare_item/1"
                }
              ],
              "repo": "https://github.com/ninenines/cowlib",
              "vendor": "ninenines",
              "versions": [
                {
                  "lessThan": "2.22.0",
                  "status": "affected",
                  "version": "2.9.0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "collectionURL": "https://github.com",
              "cpes": [
                "cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "modules": [
                "cow_http_struct_hd"
              ],
              "packageName": "ninenines/cowlib",
              "packageURL": "pkg:github/ninenines/cowlib",
              "product": "cowlib",
              "programFiles": [
                "src/cow_http_struct_hd.erl"
              ],
              "programRoutines": [
                {
                  "name": "cow_http_struct_hd:escape_string/2"
                },
                {
                  "name": "cow_http_struct_hd:bare_item/1"
                }
              ],
              "repo": "https://github.com/ninenines/cowlib",
              "vendor": "ninenines",
              "versions": [
                {
                  "lessThan": "4401b858f2229abb3ea115c60924f6c77e5f8aa3",
                  "status": "affected",
                  "version": "a8b793db3d6ffe91d62f81baf41b1dab4cd78fb6",
                  "versionType": "git"
                }
              ]
            }
          ],
          "configurations": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eThe application must pass attacker-controlled data as a string value into \u003ccode\u003ecow_http_struct_hd:item/1\u003c/code\u003e (or a wrapper that delegates to it). Applications that construct structured-fields header values exclusively from trusted, application-controlled values are not affected.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "The application must pass attacker-controlled data as a string value into `cow_http_struct_hd:item/1` (or a wrapper that delegates to it). Applications that construct structured-fields header values exclusively from trusted, application-controlled values are not affected."
                }
              ],
              "value": "The application must pass attacker-controlled data as a string value into cow_http_struct_hd:item/1 (or a wrapper that delegates to it). Applications that construct structured-fields header values exclusively from trusted, application-controlled values are not affected."
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "2.22.0",
                      "versionStartIncluding": "2.9.0",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ],
              "operator": "AND"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Peter Ullrich"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "Lo\u00efc Hoguin"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "Jonatan M\u00e4nnchen / EEF"
            }
          ],
          "datePublic": "2026-10-14T09:20:41.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eImproper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027) vulnerability in ninenines cowlib allows HTTP response splitting via non-VCHAR bytes in structured-fields string values.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003ecow_http_struct_hd:escape_string/2\u003c/code\u003e in cowlib only escapes \u003ccode\u003e\\\u003c/code\u003e and \u003ccode\u003e\"\u003c/code\u003e, passing all other bytes through verbatim. This creates an encoder/decoder asymmetry: the matching parser accepts only printable ASCII (0x20\u20130x7E, excluding \u003ccode\u003e\"\u003c/code\u003e and \u003ccode\u003e\\\u003c/code\u003e), but the encoder emits any byte including CR and LF. An application that builds a structured HTTP header via \u003ccode\u003ecow_http_struct_hd:item/1\u003c/code\u003e (or a higher-level wrapper such as \u003ccode\u003ecow_http_hd:wt_protocol/1\u003c/code\u003e) from attacker-controlled input can have \u003ccode\u003e\\r\\n\u003c/code\u003e injected into the serialized header value. Once on the wire, the injected CRLF terminates the current header and any following bytes are interpreted as a new header, enabling HTTP response splitting.\u003c/p\u003e\n\u003cp\u003eThis issue affects cowlib: from 2.9.0 before 2.22.0.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027) vulnerability in ninenines cowlib allows HTTP response splitting via non-VCHAR bytes in structured-fields string values.\n\n`cow_http_struct_hd:escape_string/2` in cowlib only escapes `\\` and `\"`, passing all other bytes through verbatim. This creates an encoder/decoder asymmetry: the matching parser accepts only printable ASCII (0x20\u20130x7E, excluding `\"` and `\\`), but the encoder emits any byte including CR and LF. An application that builds a structured HTTP header via `cow_http_struct_hd:item/1` (or a higher-level wrapper such as `cow_http_hd:wt_protocol/1`) from attacker-controlled input can have `\\r\\n` injected into the serialized header value. Once on the wire, the injected CRLF terminates the current header and any following bytes are interpreted as a new header, enabling HTTP response splitting.\n\nThis issue affects cowlib: from 2.9.0 before 2.22.0."
                }
              ],
              "value": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027) vulnerability in ninenines cowlib allows HTTP response splitting via non-VCHAR bytes in structured-fields string values.\n\ncow_http_struct_hd:escape_string/2 in cowlib only escapes \\ and \", passing all other bytes through verbatim. This creates an encoder/decoder asymmetry: the matching parser accepts only printable ASCII (0x20\u20130x7E, excluding \" and \\), but the encoder emits any byte including CR and LF. An application that builds a structured HTTP header via cow_http_struct_hd:item/1 (or a higher-level wrapper such as cow_http_hd:wt_protocol/1) from attacker-controlled input can have \\r\\n injected into the serialized header value. Once on the wire, the injected CRLF terminates the current header and any following bytes are interpreted as a new header, enabling HTTP response splitting.\n\nThis issue affects cowlib: from 2.9.0 before 2.22.0."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-34",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-34 HTTP Response Splitting"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "baseScore": 6.3,
                "baseSeverity": "MEDIUM",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "LOW",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-113",
                  "description": "CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-11-09T15:27:41.487Z",
            "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "shortName": "EEF"
          },
          "references": [
            {
              "name": "cowboy: Add invalid_response_headers HTTP/1 option",
              "tags": [
                "mitigation"
              ],
              "url": "https://github.com/ninenines/cowboy/commit/f77cb9b5e730e300fffb551db1ba5d1c4ed878ef"
            },
            {
              "name": "EEF CNA record for CVE-2026-43966",
              "tags": [
                "related",
                "third-party-advisory"
              ],
              "url": "https://cna.erlef.org/cves/CVE-2026-43966.html"
            },
            {
              "name": "OSV record EEF-CVE-2026-43966",
              "tags": [
                "related"
              ],
              "url": "https://osv.dev/vulnerability/EEF-CVE-2026-43966"
            },
            {
              "name": "gun: Add invalid_request_headers request option",
              "tags": [
                "mitigation"
              ],
              "url": "https://github.com/ninenines/gun/commit/4f35609eb37109b106a863fc9ba83d7ee64e3e42"
            },
            {
              "name": "Introducing commit a8b793d in ninenines/cowlib",
              "tags": [
                "related"
              ],
              "url": "https://github.com/ninenines/cowlib/commit/a8b793db3d6ffe91d62f81baf41b1dab4cd78fb6"
            },
            {
              "name": "Fix commit 4401b85 in ninenines/cowlib",
              "tags": [
                "patch"
              ],
              "url": "https://github.com/ninenines/cowlib/commit/4401b858f2229abb3ea115c60924f6c77e5f8aa3"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2",
          "workarounds": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eValidate all values passed into structured-fields header builders (directly via \u003ccode\u003ecow_http_struct_hd:item/1\u003c/code\u003e or indirectly via higher-level wrappers) before calling the encoder. Reject any value that is not from a trusted, application-controlled source or that contains CR (\u003ccode\u003e\\r\u003c/code\u003e) or LF (\u003ccode\u003e\\n\u003c/code\u003e) bytes.\u003c/p\u003e\n\u003cp\u003eApplications using cowboy 2.16.0 or later are protected on the server side by the \u003ccode\u003einvalid_response_headers\u003c/code\u003e option (defaults to \u003ccode\u003eerror_terminate\u003c/code\u003e), which rejects any outgoing response header value containing CR or LF before it reaches the wire. Applications using gun 2.4.0 or later are protected on the client side by the \u003ccode\u003einvalid_request_headers\u003c/code\u003e request option (defaults to \u003ccode\u003eraise\u003c/code\u003e), which raises an exception when an outgoing request header value contains CR or LF.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "Validate all values passed into structured-fields header builders (directly via `cow_http_struct_hd:item/1` or indirectly via higher-level wrappers) before calling the encoder. Reject any value that is not from a trusted, application-controlled source or that contains CR (`\\r`) or LF (`\\n`) bytes.\n\nApplications using cowboy 2.16.0 or later are protected on the server side by the `invalid_response_headers` option (defaults to `error_terminate`), which rejects any outgoing response header value containing CR or LF before it reaches the wire. Applications using gun 2.4.0 or later are protected on the client side by the `invalid_request_headers` request option (defaults to `raise`), which raises an exception when an outgoing request header value contains CR or LF."
                }
              ],
              "value": "Validate all values passed into structured-fields header builders (directly via cow_http_struct_hd:item/1 or indirectly via higher-level wrappers) before calling the encoder. Reject any value that is not from a trusted, application-controlled source or that contains CR (\\r) or LF (\\n) bytes.\n\nApplications using cowboy 2.16.0 or later are protected on the server side by the invalid_response_headers option (defaults to error_terminate), which rejects any outgoing response header value containing CR or LF before it reaches the wire. Applications using gun 2.4.0 or later are protected on the client side by the invalid_request_headers request option (defaults to raise), which raises an exception when an outgoing request header value contains CR or LF."
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "assignerShortName": "EEF",
        "cveId": "CVE-2026-43966",
        "datePublished": "2026-06-08T16:34:33.364Z",
        "dateReserved": "2026-05-04T18:23:25.573Z",
        "dateUpdated": "2026-11-09T15:27:41.487Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-43966

Vulnerability from fkie_nvd - Published: 2026-06-08 17:16 - Updated: 2026-11-09 16:17

Severity

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Summary

References

URL	Tags
6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://cna.erlef.org/cves/CVE-2026-43966.html	Third Party Advisory
6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/ninenines/cowboy/commit/f77cb9b5e730e300fffb551db1ba5d1c4ed878ef	Patch
6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/ninenines/cowlib/commit/4401b858f2229abb3ea115c60924f6c77e5f8aa3
6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/ninenines/cowlib/commit/a8b793db3d6ffe91d62f81baf41b1dab4cd78fb6
6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/ninenines/gun/commit/4f35609eb37109b106a863fc9ba83d7ee64e3e42	Patch
6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://osv.dev/vulnerability/EEF-CVE-2026-43966	Third Party Advisory

Impacted products

	Vendor	Product	Version
	ninenines	cowlib	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "cow_http_struct_hd"
          ],
          "packageName": "cowlib",
          "packageURL": "pkg:hex/cowlib",
          "product": "cowlib",
          "programFiles": [
            "src/cow_http_struct_hd.erl"
          ],
          "programRoutines": [
            {
              "name": "cow_http_struct_hd:escape_string/2"
            },
            {
              "name": "cow_http_struct_hd:bare_item/1"
            }
          ],
          "repo": "https://github.com/ninenines/cowlib",
          "vendor": "ninenines",
          "versions": [
            {
              "lessThan": "2.22.0",
              "status": "affected",
              "version": "2.9.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "cow_http_struct_hd"
          ],
          "packageName": "ninenines/cowlib",
          "packageURL": "pkg:github/ninenines/cowlib",
          "product": "cowlib",
          "programFiles": [
            "src/cow_http_struct_hd.erl"
          ],
          "programRoutines": [
            {
              "name": "cow_http_struct_hd:escape_string/2"
            },
            {
              "name": "cow_http_struct_hd:bare_item/1"
            }
          ],
          "repo": "https://github.com/ninenines/cowlib",
          "vendor": "ninenines",
          "versions": [
            {
              "lessThan": "4401b858f2229abb3ea115c60924f6c77e5f8aa3",
              "status": "affected",
              "version": "a8b793db3d6ffe91d62f81baf41b1dab4cd78fb6",
              "versionType": "git"
            }
          ]
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A583B546-6841-4B45-9E4D-67B1926640AB",
              "versionEndExcluding": "2.16.0",
              "versionStartIncluding": "2.9.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027) vulnerability in ninenines cowlib allows HTTP response splitting via non-VCHAR bytes in structured-fields string values.\n\ncow_http_struct_hd:escape_string/2 in cowlib only escapes \\ and \", passing all other bytes through verbatim. This creates an encoder/decoder asymmetry: the matching parser accepts only printable ASCII (0x20\u20130x7E, excluding \" and \\), but the encoder emits any byte including CR and LF. An application that builds a structured HTTP header via cow_http_struct_hd:item/1 (or a higher-level wrapper such as cow_http_hd:wt_protocol/1) from attacker-controlled input can have \\r\\n injected into the serialized header value. Once on the wire, the injected CRLF terminates the current header and any following bytes are interpreted as a new header, enabling HTTP response splitting.\n\nThis issue affects cowlib: from 2.9.0 before 2.22.0."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de Neutralizaci\u00f3n Incorrecta de Secuencias CRLF en Encabezados HTTP (\u0027Divisi\u00f3n de Solicitud/Respuesta HTTP\u0027) en ninenines cowlib permite la divisi\u00f3n de respuesta HTTP a trav\u00e9s de bytes no VCHAR en valores de cadena de campos estructurados.\n\ncow_http_struct_hd:escape_string/2 en cowlib solo escapa \\ y \", pasando todos los dem\u00e1s bytes textualmente. Esto crea una asimetr\u00eda de codificador/decodificador: el analizador coincidente acepta solo ASCII imprimible (0x20-0x7E, excluyendo \" y \\), pero el codificador emite cualquier byte, incluidos CR y LF. Una aplicaci\u00f3n que construye un encabezado HTTP estructurado a trav\u00e9s de cow_http_struct_hd:item/1 (o un envoltorio de nivel superior como cow_http_hd:wt_protocol/1) desde una entrada controlada por el atacante puede tener \\r\\n inyectado en el valor del encabezado serializado. Una vez en la red, el CRLF inyectado termina el encabezado actual y cualquier byte siguiente se interpreta como un nuevo encabezado, lo que permite la divisi\u00f3n de respuesta HTTP.\n\nEste problema afecta a cowlib desde la versi\u00f3n 2.9.0."
    }
  ],
  "id": "CVE-2026-43966",
  "lastModified": "2026-11-09T16:17:33.340",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "LOW",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-43966",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-08T18:37:59.853576Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-08T17:16:43.447",
  "references": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://cna.erlef.org/cves/CVE-2026-43966.html"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/ninenines/cowboy/commit/f77cb9b5e730e300fffb551db1ba5d1c4ed878ef"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/ninenines/cowlib/commit/4401b858f2229abb3ea115c60924f6c77e5f8aa3"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/ninenines/cowlib/commit/a8b793db3d6ffe91d62f81baf41b1dab4cd78fb6"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/ninenines/gun/commit/4f35609eb37109b106a863fc9ba83d7ee64e3e42"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-43966"
    }
  ],
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-113"
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary"
    }
  ]
}

GHSA-W4F7-4CXR-RV3C

Vulnerability from github – Published: 2026-06-08 18:31 – Updated: 2026-07-29 15:48

Summary

cowboy and gun affected by an HTTP Request/Response Splitting vulnerability

Details

cow_http_struct_hd:escape_string/2 in cowlib only escapes \ and ", passing all other bytes through verbatim. This creates an encoder/decoder asymmetry: the matching parser accepts only printable ASCII (0x20–0x7E, excluding " and ), but the encoder emits any byte including CR and LF. An application that builds a structured HTTP header via cow_http_struct_hd:item/1 (or a higher-level wrapper such as cow_http_hd:wt_protocol/1) from attacker-controlled input can have \r\n injected into the serialized header value. Once on the wire, the injected CRLF terminates the current header and any following bytes are interpreted as a new header, enabling HTTP response splitting.

This issue affects cowlib from 2.9.0.

Severity

6.3 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Hex",
        "name": "cowboy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.16.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 2.4.0"
      },
      "package": {
        "ecosystem": "Hex",
        "name": "gun"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.16.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-43966"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-113"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-29T15:48:39Z",
    "nvd_published_at": "2026-06-08T17:16:43Z",
    "severity": "MODERATE"
  },
  "details": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027) vulnerability in ninenines cowlib allows HTTP response splitting via non-VCHAR bytes in structured-fields string values.\n\ncow_http_struct_hd:escape_string/2 in cowlib only escapes \\ and \", passing all other bytes through verbatim. This creates an encoder/decoder asymmetry: the matching parser accepts only printable ASCII (0x20\u20130x7E, excluding \" and \\), but the encoder emits any byte including CR and LF. An application that builds a structured HTTP header via cow_http_struct_hd:item/1 (or a higher-level wrapper such as cow_http_hd:wt_protocol/1) from attacker-controlled input can have \\r\\n injected into the serialized header value. Once on the wire, the injected CRLF terminates the current header and any following bytes are interpreted as a new header, enabling HTTP response splitting.\n\nThis issue affects cowlib from 2.9.0.",
  "id": "GHSA-w4f7-4cxr-rv3c",
  "modified": "2026-07-29T15:48:39Z",
  "published": "2026-06-08T18:31:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43966"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ninenines/cowlib/pull/163#issuecomment-4952645232"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ninenines/cowlib/pull/166#issuecomment-5067554701"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ninenines/cowboy/commit/f77cb9b5e730e300fffb551db1ba5d1c4ed878ef"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ninenines/gun/commit/4f35609eb37109b106a863fc9ba83d7ee64e3e42"
    },
    {
      "type": "WEB",
      "url": "https://cna.erlef.org/cves/CVE-2026-43966.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ninenines/cowlib"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-43966"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "cowboy and gun affected by an HTTP Request/Response Splitting vulnerability"
}

MSRC_CVE-2026-43966

Vulnerability from csaf_microsoft - Published: 2026-06-19 01:01 - Updated: 2026-07-15 01:39

Summary

HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2

Scope

1 vulnerability in this advisory, including CVE-2026-43966.

CVE-2026-43966

Fixed: 1 product Known affected: 2 products

https://learn.microsoft.com/en-us/azure/azure-linux/tutoria…

Open the full advisory

UBUNTU-CVE-2026-43966 (CVE-2026-43966)

Vulnerability from osv_ubuntu – Published: 2026-06-15 00:00 – Updated: 2026-06-17 08:57 – Source website

Withdrawn 2026-06-19

Details

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in ninenines cowlib allows HTTP response splitting via non-VCHAR bytes in structured-fields string values. cow_http_struct_hd:escape_string/2 in cowlib only escapes \ and ", passing all other bytes through verbatim. This creates an encoder/decoder asymmetry: the matching parser accepts only printable ASCII (0x20–0x7E, excluding " and ), but the encoder emits any byte including CR and LF. An application that builds a structured HTTP header via cow_http_struct_hd:item/1 (or a higher-level wrapper such as cow_http_hd:wt_protocol/1) from attacker-controlled input can have \r\n injected into the serialized header value. Once on the wire, the injected CRLF terminates the current header and any following bytes are interpreted as a new header, enabling HTTP response splitting. This issue affects cowlib from 2.9.0.

Severity

6.3 (Medium)


                    
                      CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-43966	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-43966	REPORT
	https://cna.erlef.org/cves/CVE-2026-43966.html	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "rabbitmq-server",
            "binary_version": "3.5.7-1ubuntu0.16.04.4+esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "rabbitmq-server",
        "purl": "pkg:deb/ubuntu/rabbitmq-server@3.5.7-1ubuntu0.16.04.4+esm2?arch=source\u0026distro=esm-infra/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.5.4-1",
        "3.5.4-3",
        "3.5.4-3.1",
        "3.5.7-1",
        "3.5.7-1ubuntu0.16.04.1",
        "3.5.7-1ubuntu0.16.04.2",
        "3.5.7-1ubuntu0.16.04.4",
        "3.5.7-1ubuntu0.16.04.4+esm1",
        "3.5.7-1ubuntu0.16.04.4+esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "rabbitmq-server",
            "binary_version": "3.6.10-1ubuntu0.5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "rabbitmq-server",
        "purl": "pkg:deb/ubuntu/rabbitmq-server@3.6.10-1ubuntu0.5?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.6.10-1",
        "3.6.10-1ubuntu0.1",
        "3.6.10-1ubuntu0.3",
        "3.6.10-1ubuntu0.4",
        "3.6.10-1ubuntu0.5"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "rabbitmq-server",
            "binary_version": "3.8.3-0ubuntu0.3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "rabbitmq-server",
        "purl": "pkg:deb/ubuntu/rabbitmq-server@3.8.3-0ubuntu0.3?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.7.8-4ubuntu2",
        "3.7.18-1",
        "3.8.2-0ubuntu1",
        "3.8.2-0ubuntu1.1",
        "3.8.2-0ubuntu1.2",
        "3.8.2-0ubuntu1.3",
        "3.8.2-0ubuntu1.4",
        "3.8.2-0ubuntu1.5",
        "3.8.3-0ubuntu0.1",
        "3.8.3-0ubuntu0.2",
        "3.8.3-0ubuntu0.3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "rabbitmq-server",
            "binary_version": "3.9.27-0ubuntu0.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "rabbitmq-server",
        "purl": "pkg:deb/ubuntu/rabbitmq-server@3.9.27-0ubuntu0.2?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.8.9-3ubuntu1",
        "3.9.8-1",
        "3.9.8-2",
        "3.9.8-3",
        "3.9.8-5",
        "3.9.8-6",
        "3.9.13-1",
        "3.9.13-1ubuntu0.22.04.1",
        "3.9.13-1ubuntu0.22.04.2",
        "3.9.27-0ubuntu0.1",
        "3.9.27-0ubuntu0.2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "rabbitmq-server",
            "binary_version": "3.12.1-1ubuntu1.4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "rabbitmq-server",
        "purl": "pkg:deb/ubuntu/rabbitmq-server@3.12.1-1ubuntu1.4?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.12.1-1",
        "3.12.1-1ubuntu1",
        "3.12.1-1ubuntu1.2",
        "3.12.1-1ubuntu1.4"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "rabbitmq-server",
            "binary_version": "4.0.5-8ubuntu2.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "rabbitmq-server",
        "purl": "pkg:deb/ubuntu/rabbitmq-server@4.0.5-8ubuntu2.1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.0.5-2ubuntu2",
        "4.0.5-6ubuntu1",
        "4.0.5-8ubuntu1",
        "4.0.5-8ubuntu2",
        "4.0.5-8ubuntu2.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "rabbitmq-server",
            "binary_version": "4.0.5-10ubuntu5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "rabbitmq-server",
        "purl": "pkg:deb/ubuntu/rabbitmq-server@4.0.5-10ubuntu5?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.0.5-8ubuntu2",
        "4.0.5-10ubuntu1",
        "4.0.5-10ubuntu2",
        "4.0.5-10ubuntu3",
        "4.0.5-10ubuntu4",
        "4.0.5-10ubuntu5"
      ]
    }
  ],
  "aliases": [],
  "details": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027) vulnerability in ninenines cowlib allows HTTP response splitting via non-VCHAR bytes in structured-fields string values. cow_http_struct_hd:escape_string/2 in cowlib only escapes \\ and \", passing all other bytes through verbatim. This creates an encoder/decoder asymmetry: the matching parser accepts only printable ASCII (0x20\u20130x7E, excluding \" and \\), but the encoder emits any byte including CR and LF. An application that builds a structured HTTP header via cow_http_struct_hd:item/1 (or a higher-level wrapper such as cow_http_hd:wt_protocol/1) from attacker-controlled input can have \\r\\n injected into the serialized header value. Once on the wire, the injected CRLF terminates the current header and any following bytes are interpreted as a new header, enabling HTTP response splitting. This issue affects cowlib from 2.9.0.",
  "id": "UBUNTU-CVE-2026-43966",
  "modified": "2026-06-17T08:57:56Z",
  "published": "2026-06-15T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-43966"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43966"
    },
    {
      "type": "REPORT",
      "url": "https://cna.erlef.org/cves/CVE-2026-43966.html"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
      "type": "CVSS_V4"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-43966"
  ],
  "withdrawn": "2026-06-19T15:57:11Z"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-43966 (GCVE-0-2026-43966)

FKIE_CVE-2026-43966

GHSA-W4F7-4CXR-RV3C

MSRC_CVE-2026-43966

UBUNTU-CVE-2026-43966 (CVE-2026-43966)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour