{"id":"EEF-CVE-2026-43971","summary":"Link Header Directive Smuggling via Unescaped target/rel/Attribute Keys in cow_link:link/1","details":"## Summary\n\nImproper Encoding or Escaping of Output vulnerability in ninenines cowlib allows Link header directive smuggling via unescaped special characters in `cow_link:link/1`.\n\n`cow_link:do_link/1` in cowlib interpolates the target URI, rel value, and attribute keys directly into the serialized `Link:` header value without escaping or token-grammar validation. A `\u003e` byte in target prematurely closes the URI slot, allowing an attacker to append additional link entries with attacker-chosen rel directives. A `\"` or `\\` in rel escapes the quoted string and opens new parameters. Any byte — including whitespace, `=`, and `\"` — in an attribute key is emitted verbatim. Because browsers act on `Link:` directives such as `rel=\"preconnect\"`, `rel=\"preload\"`, and `rel=\"prerender\"`, an attacker who can influence these fields in an application that round-trips parsed Link headers through `cow_link:link/1` can force victim browsers to make out-of-band connections to attacker-controlled origins.\n\nThis issue affects cowlib: from 2.9.0 before 2.20.0.\n\n## Workarounds\n\nSanitize values before passing them to `cow_link:link/1`: reject or strip any target value containing `\u003e`, any rel value containing `\"` or `\\`, and any attribute key containing characters outside the HTTP token grammar. Alternatively, ensure all Link entry fields are derived exclusively from trusted, application-controlled values rather than untrusted input.\n\n## Configurations\n\nThe application must pass values that originate from, or can be influenced by, untrusted input into `cow_link:link/1` — specifically the target URI, rel value, or attribute keys. Applications that construct Link entries exclusively from trusted, application-controlled values are not affected.","aliases":["CVE-2026-43971"],"modified":"2026-09-16T20:30:35.688617126Z","published":"2026-08-18T09:01:53.199Z","database_specific":{"cpe_ids":["cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"],"cwe_ids":["CWE-116"],"capec_ids":["CAPEC-137"]},"references":[{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-43971.html"},{"type":"WEB","url":"https://github.com/ninenines/cowlib/commit/485d58dfa91b91d98135dc95e5615f421715dae5"},{"type":"FIX","url":"https://github.com/ninenines/cowlib/commit/89da27ee4c241f5d649ba7d9b7f2188918af6cea"},{"type":"PACKAGE","url":"https://hex.pm/packages/cowlib"}],"affected":[{"package":{"name":"cowlib","ecosystem":"Hex","purl":"pkg:hex/cowlib"},"ranges":[{"type":"SEMVER","events":[{"introduced":"2.9.0"},{"fixed":"2.20.0"}]}],"versions":["2.10.0","2.10.1","2.11.0","2.12.0","2.12.1","2.13.0","2.14.0","2.15.0","2.16.0","2.16.1","2.17.0","2.17.1","2.18.0","2.19.0","2.9.0","2.9.1"],"database_specific":{"source":"https://cna.erlef.org/osv/EEF-CVE-2026-43971.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/ninenines/cowlib","events":[{"introduced":"485d58dfa91b91d98135dc95e5615f421715dae5"},{"fixed":"89da27ee4c241f5d649ba7d9b7f2188918af6cea"}]}],"versions":["2.19.0","2.18.0","2.17.1","2.17.0","2.16.1","2.16.0","2.15.0","2.14.0","2.13.0","2.12.1","2.12.0","2.11.0","2.10.1","2.10.0","2.9.1","2.9.0"],"database_specific":{"source":"https://cna.erlef.org/osv/EEF-CVE-2026-43971.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N"}],"credits":[{"name":"Peter Ullrich","type":"FINDER"},{"name":"Jonatan Männchen / EEF","type":"REMEDIATION_DEVELOPER"},{"name":"Loïc Hoguin","type":"REMEDIATION_REVIEWER"}]}