CVE-2026-43971
Received Received - Intake

Link Header Injection in cowlib

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: EEF

Description
Improper Encoding or Escaping of Output vulnerability in ninenines cowlib allows Link header directive smuggling via unescaped special characters in cow_link:link/1. cow_link:do_link/1 in cowlib interpolates the target URI, rel value, and attribute keys directly into the serialized Link: header value without escaping or token-grammar validation. A > byte in target prematurely closes the URI slot, allowing an attacker to append additional link entries with attacker-chosen rel directives. A " or \ in rel escapes the quoted string and opens new parameters. Any byte — including whitespace, =, and " — in an attribute key is emitted verbatim. Because browsers act on Link: directives such as rel="preconnect", rel="preload", and rel="prerender", an attacker who can influence these fields in an application that round-trips parsed Link headers through cow_link:link/1 can force victim browsers to make out-of-band connections to attacker-controlled origins. This issue affects cowlib: from 2.9.0 onward.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-43971
EUVD
EUVD-2026-60573

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ninenines cowlib From 2.9.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-116 The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in ninenines cowlib allows Link header directive smuggling due to improper encoding or escaping of output. The cow_link:link/1 function interpolates target URIs, rel values, and attribute keys directly into the Link header without escaping or validation. Attackers can exploit this by inserting special characters to inject malicious link entries, forcing browsers to connect to attacker-controlled origins.

Detection Guidance

Detecting this vulnerability requires checking if your system uses cowlib versions 2.9.0 or later and inspecting Link headers for improperly escaped characters. Review application logs for Link headers containing unescaped special characters like >, ", or \. Use tools like curl to inspect headers: curl -I http://your-server. Check if cow_link:link/1 is called with untrusted input.

Impact Analysis

An attacker could manipulate Link headers to make victim browsers initiate unauthorized connections to malicious servers. This could lead to data exfiltration, phishing attacks, or unauthorized resource access. Systems using cowlib 2.9.0 or later are at risk if they process untrusted input through cow_link:link/1.

Compliance Impact

This vulnerability could lead to unauthorized data exposure or connections, potentially violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations must ensure proper input sanitization to maintain compliance.

Mitigation Strategies

Sanitize input before passing it to cow_link:link/1 or ensure all Link entry fields are derived from trusted sources. Avoid using cowlib versions 2.9.0 and later without applying patches or updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-43971. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart