{"affected":[{"package":{"ecosystem":"Hex","name":"cowlib","purl":"pkg:hex/cowlib"},"ranges":[{"events":[{"introduced":"2.9.0"}],"type":"SEMVER"}],"versions":["2.9.0","2.9.1","2.10.0","2.10.1","2.11.0","2.12.0","2.12.1","2.13.0","2.14.0","2.15.0","2.16.0","2.16.1","2.17.0","2.17.1","2.18.0","2.19.0"]},{"ranges":[{"events":[{"introduced":"485d58dfa91b91d98135dc95e5615f421715dae5"},{"fixed":"89da27ee4c241f5d649ba7d9b7f2188918af6cea"}],"repo":"https://github.com/ninenines/cowlib","type":"GIT"}]}],"aliases":["CVE-2026-43971"],"credits":[{"name":"Peter Ullrich","type":"FINDER"},{"name":"Jonatan Männchen / EEF","type":"REMEDIATION_DEVELOPER"},{"name":"Loïc Hoguin","type":"REMEDIATION_REVIEWER"}],"database_specific":{"capec_ids":["CAPEC-137"],"cpe_ids":["cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"],"cwe_ids":["CWE-116"]},"details":"## Summary\n\nImproper Encoding or Escaping of Output vulnerability in ninenines cowlib allows Link header directive smuggling via unescaped special characters in cow\\_link:link/1.\n\ncow\\_link:do\\_link/1 in cowlib interpolates the target URI, rel value, and attribute keys directly into the serialized Link: header value without escaping or token-grammar validation. A > byte in target prematurely closes the URI slot, allowing an attacker to append additional link entries with attacker-chosen rel directives. A \" or \\\\ in rel escapes the quoted string and opens new parameters. Any byte — including whitespace, =, and \" — in an attribute key is emitted verbatim. Because browsers act on Link: directives such as rel=\"preconnect\", rel=\"preload\", and rel=\"prerender\", an attacker who can influence these fields in an application that round-trips parsed Link headers through cow\\_link:link/1 can force victim browsers to make out-of-band connections to attacker-controlled origins.\n\nThis issue affects cowlib: from 2.9.0 onward.\n\n## Workaround\n\nSanitize values before passing them to cow\\_link:link/1: reject or strip any target value containing >, any rel value containing \" or \\\\, and any attribute key containing characters outside the HTTP token grammar. Alternatively, ensure all Link entry fields are derived exclusively from trusted, application-controlled values rather than untrusted input.\n\n## Configuration\n\nThe application must pass values that originate from, or can be influenced by, untrusted input into cow\\_link:link/1 — specifically the target URI, rel value, or attribute keys. Applications that construct Link entries exclusively from trusted, application-controlled values are not affected.","id":"EEF-CVE-2026-43971","modified":"2026-08-18T15:58:46.741839Z","published":"2026-08-18T09:01:53.199Z","references":[{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-43971.html"},{"type":"FIX","url":"https://github.com/ninenines/cowlib/commit/89da27ee4c241f5d649ba7d9b7f2188918af6cea"},{"type":"PACKAGE","url":"https://hex.pm/packages/cowlib"}],"related":[],"schema_version":"1.7.3","severity":[{"score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","type":"CVSS_V4"}],"summary":"Link Header Directive Smuggling via Unescaped target/rel/Attribute Keys in cow_link:link/1","upstream":[]}