Read the docs
TI-2026-32013 Aliases CVE-2026-43968GHSA-hv23-4qp7-8c8r

CR Injection in SSE Encoder Enables Event Splitting via cow_sse:event/1

Priority LOW 28CWE-93Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows SSE event splitting and injection via unvalidated field values. cow_sse:event/1 in cowlib guards the id and event fields against \n but not against bare \r, and the internal prefix_lines/2 function used for data and comment fields splits only on \n. Because the SSE specification requires decoders to treat \r\n, \r, and \n as equivalent line terminators, an attacker who controls any of these fields can inject additional SSE lines and forge a complete event with an arbitrary event type and data payload on the receiving end. In typical deployments where browser EventSource clients or other SSE consumers dispatch on event.type and render event.data, this enables event splitting, client-side logic manipulation, and stored-XSS-equivalent behaviour when event data is inserted into the DOM. This issue affects cowlib from 2.6.0 before 2.16.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00266 18th percentileScored 2026-11-07
Fix Fixed cowlib (ninenines): 2.16.1cowlib (Hex): 2.16.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nineninescowlib2.6.0 to before 2.16.12.16.1Patch availableCNA
—cowlib (Hex)2.6.0 to before 2.16.12.16.1Patch availableGHSA-hv23-4qp7-8c8r
  • cowlib Vendorninenines Affected 2.6.0 to before 2.16.1 Fixed in 2.16.1 Patch available CNA
  • cowlib (Hex) Vendor— Affected 2.6.0 to before 2.16.1 Fixed in 2.16.1 Patch available GHSA-hv23-4qp7-8c8r

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*2.6.0 to before 2.16.1Vulnerableninenines
  • cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:* Versions 2.6.0 to before 2.16.1 Vulnerable ·ninenines

Remediation

  • Fix · CNA cowlib (ninenines) Fixed in 2.16.1
  • Fix · GHSA-hv23-4qp7-8c8r cowlib (Hex) Fixed in 2.16.1 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    ninenines cowlib 2.16.1

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-06860 Unbounded chunk-size hex digits in cowlib cause quadratic CPU and memory DoSPriority MEDIUM 44
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-43968
  2. 2026-10-03 Alias added: GHSA-hv23-4qp7-8c8r

References

Patch 1

Advisory 3

Other 2

  • TI-2026-06860 Unbounded chunk-size hex digits in cowlib cause quadratic CPU and memory DoS CVSS 4.0HIGH 8.7
  • TI-2026-32011 HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2 CVSS 4.0MEDIUM 6.3
  • TI-2026-32014 Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1 CVSS 4.0LOW 2.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences