CVE-2026-43968— CR Injection in SSE Encoder Enables Event Splitting via cow_sse:event/1

CR Injection in SSE Encoder Enables Event Splitting via cow_sse:event/1

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows SSE event splitting and injection via unvalidated field values. cow_sse:event/1 in cowlib guards the id and event fields against \n but not against bare \r, and the internal prefix_lines/2 function used for data and comment fields splits only on \n. Because the SSE specification requires decoders to treat \r\n, \r, and \n as equivalent line terminators, an attacker who controls any of these fields can inject additional SSE lines and forge a complete event with an arbitrary event type and data payload on the receiving end. In typical deployments where browser EventSource clients or other SSE consumers dispatch on event.type and render event.data, this enables event splitting, client-side logic manipulation, and stored-XSS-equivalent behaviour when event data is inserted into the DOM. This issue affects cowlib from 2.6.0 before 2.16.1.

N/A

对CRLF序列的转义处理不恰当(CRLF注入)

Cowlib 注入漏洞

Cowlib是Nine Nines开源的一个Web协议消息解析与构建库。 cowlib 2.6.0版本存在注入漏洞，该漏洞源于cow_sse:event/1在cowlib中保护id和event字段免受 攻击但未保护裸 ，且内部prefix_lines/2函数仅按 分割，由于SSE规范要求解码器将 、 和 视为等效行终止符，控制任何这些字段的攻击者可注入额外SSE行并在接收端伪造具有任意事件类型和数据有效载荷的完整事件。

N/A

N/A