Link Header Directive Smuggling via Unescaped target/rel/Attribute Keys in cow_link:link/1
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 1 fixed, 3 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.
Summary
Improper Encoding or Escaping of Output vulnerability in ninenines cowlib allows Link header directive smuggling via unescaped special characters in cow_link:link/1. cow_link:do_link/1 in cowlib interpolates the target URI, rel value, and attribute keys directly into the serialized Link: header value without escaping or token-grammar validation. A > byte in target prematurely closes the URI slot, allowing an attacker to append additional link entries with attacker-chosen rel directives. A " or \ in rel escapes the quoted string and opens new parameters. Any byte — including whitespace, =, and " — in an attribute key is emitted verbatim. Because browsers act on Link: directives such as rel="preconnect", rel="preload", and rel="prerender", an attacker who can influence these fields in an application that round-trips parsed Link headers through cow_link:link/1 can force victim browsers to make out-of-band connections to attacker-controlled origins. This issue affects cowlib: from 2.9.0 before 2.20.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA cowlib (ninenines) Fixed in 2.20.0
Red Hat 1 advisory
- RHSA-2026:66210 Released 2026-09-09 · Red Hat rating ModerateRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images rabbitmq-server4-3-main@aarch64, rabbitmq-server4-3-main@src, rabbitmq-server4-3-main@x86_64
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Hardened Images | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 17.1 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 18.0 | Affected | No fix yet: Fix deferred |
| Red Hat Hardened Images | Fixed | RHSA-2026:66210 |
Not affected: 1 product
- Red Hat OpenStack Platform 16.2
Timeline
- 2026-10-02 Threatist record created from CVE-2026-43971
- 2026-10-03 Alias added: GHSA-gg23-fwhr-prjh
References
More ninenines vulnerabilities
- TI-2026-32019 gun HTTP/1.1 client accepts unsolicited 101 Switching Protocols response allowing server-driven protocol hijack and OOM CVSS 4.0HIGH 8.7
- TI-2026-32018 gun HTTP/1.1 response buffer has no size limit allowing server-controlled memory exhaustion CVSS 4.0HIGH 8.7
- TI-2026-06860 Unbounded chunk-size hex digits in cowlib cause quadratic CPU and memory DoS CVSS 4.0HIGH 8.7
- TI-2026-42388 Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS CVSS 4.0HIGH 8.7
- TI-2026-85816 Unbounded HTTP/2 header list size in cowlib enables memory exhaustion CVSS 4.0HIGH 8.7
- TI-2026-46781 Cowboy HTTP/1.1 max_headers Bypass via Duplicate Header Names Enables Memory Exhaustion CVSS 4.0MEDIUM 6.9
Sources
- CVE-2026-43971 · CVE Program
- CVE-2026-43971 · NVD
- FIRST EPSS
- GHSA-gg23-fwhr-prjh · GitHub Advisory Database · CC BY 4.0
- CVE-2026-43971 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences