CVE-2026-43968

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-43968

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43968.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-43968

Aliases

Published

2026-05-11T18:06:42.881Z

Modified

2026-07-15T01:48:51.819545347Z

Severity

6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N CVSS Calculator

Summary

CR Injection in SSE Encoder Enables Event Splitting via cow_sse:event/1

Details

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows SSE event splitting and injection via unvalidated field values.

cowsse:event/1 in cowlib guards the id and event fields against \n but not against bare \r, and the internal prefixlines/2 function used for data and comment fields splits only on \n. Because the SSE specification requires decoders to treat \r\n, \r, and \n as equivalent line terminators, an attacker who controls any of these fields can inject additional SSE lines and forge a complete event with an arbitrary event type and data payload on the receiving end. In typical deployments where browser EventSource clients or other SSE consumers dispatch on event.type and render event.data, this enables event splitting, client-side logic manipulation, and stored-XSS-equivalent behaviour when event data is inserted into the DOM.

This issue affects cowlib from 2.6.0 before 2.16.1.

Database specific

{
    "cwe_ids": [
        "CWE-93"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43968.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "93b2b897cde238506c803faad4d1602d79dba7c9"
                },
                {
                    "fixed": "6165fc40efa159ba1cceee7e7981e790acba5d9c"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "EEF"
}

References

Affected packages

Git / github.com/ninenines/cowlib

Affected ranges

Type

GIT

Repo

https://github.com/ninenines/cowlib

Events

Introduced

106ba84bb04537879d8ce59321a04e0682110b91

Fixed

bae6b022af54566f3518a3aa59083b4591d552de

Fixed

6165fc40efa159ba1cceee7e7981e790acba5d9c

Database specific

{
    "cpe": "cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.6.0"
        },
        {
            "fixed": "2.16.1"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

2.*

2.10.0

2.10.1

2.11.0

2.12.0

2.12.1

2.13.0

2.14.0

2.15.0

2.16.0

2.6.0

2.7.0

2.7.1

2.7.2

2.7.3

2.8.0

2.9.0

2.9.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43968.json"