CVE-2026-43968

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-43968
Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows SSE event splitting and injection via unvalidated field values. cow_sse:event/1 in cowlib guards the id and event fields against \n but not against bare \r, and the internal prefix_lines/2 function used for data and comment fields splits only on \n. Because the SSE specification requires decoders to treat \r\n, \r, and \n as equivalent line terminators, an attacker who controls any of these fields can inject additional SSE lines and forge a complete event with an arbitrary event type and data payload on the receiving end. In typical deployments where browser EventSource clients or other SSE consumers dispatch on event.type and render event.data, this enables event splitting, client-side logic manipulation, and stored-XSS-equivalent behaviour when event data is inserted into the DOM. This issue affects cowlib from 2.6.0 before 2.16.1.

4.0 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://cna.erlef.org/cves/CVE-2026-43968.html Vendor Advisory
https://github.com/ninenines/cowlib/commit/6165fc40efa159ba1cceee7e7981e790acba5d9c Patch
https://osv.dev/vulnerability/EEF-CVE-2026-43968 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*
History

21 May 2026, 13:59

Type Values Removed Values Added
References () https://cna.erlef.org/cves/CVE-2026-43968.html - () https://cna.erlef.org/cves/CVE-2026-43968.html - Vendor Advisory
References () https://github.com/ninenines/cowlib/commit/6165fc40efa159ba1cceee7e7981e790acba5d9c - () https://github.com/ninenines/cowlib/commit/6165fc40efa159ba1cceee7e7981e790acba5d9c - Patch
References () https://osv.dev/vulnerability/EEF-CVE-2026-43968 - () https://osv.dev/vulnerability/EEF-CVE-2026-43968 - Third Party Advisory
CPE cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*
First Time Ninenines cowlib
Ninenines
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.0

12 May 2026, 13:17

Type Values Removed Values Added
Summary (en) Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows SSE event splitting and injection via unvalidated field values. cow_sse:event/1 in cowlib guards the id and event fields against \n but not against bare \r, and the internal prefix_lines/2 function used for data and comment fields splits only on \n. Because the SSE specification requires decoders to treat \r\n, \r, and \n as equivalent line terminators, an attacker who controls any of these fields can inject additional SSE lines and forge a complete event with an arbitrary event type and data payload on the receiving end. In typical deployments where browser EventSource clients or other SSE consumers dispatch on event.type and render event.data, this enables event splitting, client-side logic manipulation, and stored-XSS-equivalent behaviour when event data is inserted into the DOM. This issue affects cowlib from 2.6.0. (en) Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows SSE event splitting and injection via unvalidated field values. cow_sse:event/1 in cowlib guards the id and event fields against \n but not against bare \r, and the internal prefix_lines/2 function used for data and comment fields splits only on \n. Because the SSE specification requires decoders to treat \r\n, \r, and \n as equivalent line terminators, an attacker who controls any of these fields can inject additional SSE lines and forge a complete event with an arbitrary event type and data payload on the receiving end. In typical deployments where browser EventSource clients or other SSE consumers dispatch on event.type and render event.data, this enables event splitting, client-side logic manipulation, and stored-XSS-equivalent behaviour when event data is inserted into the DOM. This issue affects cowlib from 2.6.0 before 2.16.1.

11 May 2026, 19:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-05-11 19:16

Updated : 2026-05-21 13:59

NVD link : CVE-2026-43968

Mitre link : CVE-2026-43968

CVE.ORG link : CVE-2026-43968

JSON object : View

Products Affected

ninenines

  • cowlib
CWE
CWE-93

Improper Neutralization of CRLF Sequences ('CRLF Injection')