CVE-2026-43971 - Link Header Directive Smuggling via Unescaped target/rel/Attribute Keys in cow_link:link/1
Brief
CVE ID : CVE-2026-43971
Published : Aug. 18, 2026, 9:17 a. m.
- 1 hour, 51 minutes ago
Description : Improper Encoding or Escaping of Output vulnerability in ninenines cowlib allows Link header directive smuggling via unescaped special characters in cow_link:link/1.
cow_link:do_link/1 in cowlib interpolates the target URI, rel value, and attribute keys directly into the serialized Link: header value without escaping or token-grammar validation. A byte in target prematurely closes the URI slot, allowing an attacker to append additional link entries with attacker-chosen rel directives. A " or \ in rel escapes the quoted string and opens new parameters.
Any byte — including whitespace, =, and " — in an attribute key is emitted verbatim.