CVE-2026-43971

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-43971
Improper Encoding or Escaping of Output vulnerability in ninenines cowlib allows Link header directive smuggling via unescaped special characters in cow_link:link/1. cow_link:do_link/1 in cowlib interpolates the target URI, rel value, and attribute keys directly into the serialized Link: header value without escaping or token-grammar validation. A > byte in target prematurely closes the URI slot, allowing an attacker to append additional link entries with attacker-chosen rel directives. A " or \ in rel escapes the quoted string and opens new parameters. Any byte — including whitespace, =, and " — in an attribute key is emitted verbatim. Because browsers act on Link: directives such as rel="preconnect", rel="preload", and rel="prerender", an attacker who can influence these fields in an application that round-trips parsed Link headers through cow_link:link/1 can force victim browsers to make out-of-band connections to attacker-controlled origins. This issue affects cowlib: from 2.9.0 before 2.20.0.
CVSS

No CVSS.

References
Link Resource
https://cna.erlef.org/cves/CVE-2026-43971.html
https://github.com/ninenines/cowlib/commit/485d58dfa91b91d98135dc95e5615f421715dae5
https://github.com/ninenines/cowlib/commit/89da27ee4c241f5d649ba7d9b7f2188918af6cea
https://osv.dev/vulnerability/EEF-CVE-2026-43971
Configurations

No configuration.

History

22 Oct 2026, 22:10

Type Values Removed Values Added
Summary
  • (es) La vulnerabilidad de codificación o escape de salida incorrectos en ninenines cowlib permite el contrabando de directivas de encabezado Link a través de caracteres especiales sin escape en cow_link:link/1. cow_link:do_link/1 en cowlib interpola la URI de destino, el valor rel y las claves de atributo directamente en el valor del encabezado Link: serializado sin escape ni validación de gramática de tokens. Un byte > en el destino cierra prematuramente la ranura URI, permitiendo a un atacante añadir entradas de enlace adicionales con directivas rel elegidas por el atacante. Un ’ o \ en rel escapa la cadena entre comillas y abre nuevos parámetros. Cualquier byte -incluyendo espacios en blanco, =, y ’- en una clave de atributo se emite textualmente. Debido a que los navegadores actúan sobre directivas Link: como rel=’preconnect’, rel=’preload’ y rel=’prerender’, un atacante que puede influir en estos campos en una aplicación que procesa encabezados Link analizados a través de cow_link:link/1 puede forzar a los navegadores de las víctimas a realizar conexiones fuera de banda a orígenes controlados por el atacante. Este problema afecta a cowlib: a partir de la versión 2.9.0.

16 Sep 2026, 21:17

Type Values Removed Values Added
References
  • () https://github.com/ninenines/cowlib/commit/485d58dfa91b91d98135dc95e5615f421715dae5 -
Summary (en) Improper Encoding or Escaping of Output vulnerability in ninenines cowlib allows Link header directive smuggling via unescaped special characters in cow_link:link/1. cow_link:do_link/1 in cowlib interpolates the target URI, rel value, and attribute keys directly into the serialized Link: header value without escaping or token-grammar validation. A > byte in target prematurely closes the URI slot, allowing an attacker to append additional link entries with attacker-chosen rel directives. A " or \ in rel escapes the quoted string and opens new parameters. Any byte — including whitespace, =, and " — in an attribute key is emitted verbatim. Because browsers act on Link: directives such as rel="preconnect", rel="preload", and rel="prerender", an attacker who can influence these fields in an application that round-trips parsed Link headers through cow_link:link/1 can force victim browsers to make out-of-band connections to attacker-controlled origins. This issue affects cowlib: from 2.9.0 onward. (en) Improper Encoding or Escaping of Output vulnerability in ninenines cowlib allows Link header directive smuggling via unescaped special characters in cow_link:link/1. cow_link:do_link/1 in cowlib interpolates the target URI, rel value, and attribute keys directly into the serialized Link: header value without escaping or token-grammar validation. A > byte in target prematurely closes the URI slot, allowing an attacker to append additional link entries with attacker-chosen rel directives. A " or \ in rel escapes the quoted string and opens new parameters. Any byte — including whitespace, =, and " — in an attribute key is emitted verbatim. Because browsers act on Link: directives such as rel="preconnect", rel="preload", and rel="prerender", an attacker who can influence these fields in an application that round-trips parsed Link headers through cow_link:link/1 can force victim browsers to make out-of-band connections to attacker-controlled origins. This issue affects cowlib: from 2.9.0 before 2.20.0.
Information

Published : 2026-08-18 09:17

Updated : 2026-10-22 22:10

NVD link : CVE-2026-43971

Mitre link : CVE-2026-43971

CVE.ORG link : CVE-2026-43971

JSON object : View

Products Affected

No product.

CWE
CWE-116

Improper Encoding or Escaping of Output