{"id":"AZL-90162","summary":"CVE-2026-43966 affecting package rabbitmq-server for versions less than 3.13.7-8","details":"Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in ninenines cowlib allows HTTP response splitting via non-VCHAR bytes in structured-fields string values.\n\ncow_http_struct_hd:escape_string/2 in cowlib only escapes \\ and \", passing all other bytes through verbatim. This creates an encoder/decoder asymmetry: the matching parser accepts only printable ASCII (0x20–0x7E, excluding \" and \\), but the encoder emits any byte including CR and LF. An application that builds a structured HTTP header via cow_http_struct_hd:item/1 (or a higher-level wrapper such as cow_http_hd:wt_protocol/1) from attacker-controlled input can have \\r\\n injected into the serialized header value. Once on the wire, the injected CRLF terminates the current header and any following bytes are interpreted as a new header, enabling HTTP response splitting.\n\nThis issue affects cowlib from 2.9.0.","modified":"2026-08-30T05:26:50Z","published":"2026-06-08T17:16:43Z","upstream":["CVE-2026-43966"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43966"}],"affected":[{"package":{"name":"rabbitmq-server","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/rabbitmq-server"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.7-8"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-90162.json"}}],"schema_version":"1.9.0"}