Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| cowlib | erlang | >= 2.6.0, < 2.16.1 | 2.16.1 |
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-43968, is a CRLF injection flaw in the cowlib library's Server-Sent Events (SSE) handling. The core issue is that the library failed to properly sanitize input for different fields of an SSE event, specifically not accounting for carriage return (\r) characters as line terminators, only newline (\n) characters. The SSE specification treats \r, \n, and \r\n as valid line terminators. This discrepancy allowed an attacker to inject fake SSE events by crafting input with \r.
The analysis of the patch 6165fc40efa159ba1cceee7e7981e790acba5d9c reveals the exact locations of the vulnerability and the fix.
cow_sse:event_id/1 and cow_sse:event_name/1: These functions were responsible for validating the id and event fields, respectively. The patch shows that they were changed from only checking for \n to checking for \r, \n, and \r\n, confirming they were vulnerable.cow_sse:prefix_lines/2: This function is used to format multi-line data for fields like data and comment. The patch shows it was modified to split lines using \r, \n, and \r\n as delimiters, whereas before it only used \n. This confirms it was a source of the vulnerability.cow_sse:event/1: This is the primary public function that constructs the SSE event from a map. It serves as the entry point for the vulnerability, as it orchestrates the calls to the other vulnerable functions. Exploitation of this vulnerability would involve a call to cow_sse:event/1 with a malicious payload in the map's values.Therefore, during an exploit, a runtime profile would show cow_sse:event/1 being called, which in turn would call cow_sse:event_id/1, cow_sse:event_name/1, or use cow_sse:prefix_lines/2 depending on the malicious input provided. These are the key functions involved in the vulnerable processing logic.