This vulnerability allows HTTP response splitting through non‑VCHAR bytes in structured‑fields header values. It arises from cow_http_struct_hd:escape_string/2 in cowlib, which only escapes backslash and double‑quote characters, leaving all other bytes unchanged. Because the encoder can emit any byte, including carriage return and line feed, while the parser only accepts printable ASCII, an attacker can inject CRLF sequences into a header built via cow_http_struct_hd:item/1 or higher‑level wrappers. When transmitted, these injected sequences terminate the current header and the following bytes are treated as a new header, allowing response‑splitting attacks that may lead to header injection, cache poisoning, or cross‑site scripting. The weakness is classified as CWE‑113.

The vulnerability is present in versions of the cowlib library from 2.9.0 onward. Applications that depend on cowlib directly, or through higher‑level frameworks such as cowboy 2.16.0+ and gun 2.4.0+, are potentially exposed. Practical mitigation is available in those frameworks via configuration: cowboy can be configured with invalid_response_headers set to error_terminate, while gun offers an invalid_request_headers option that raises an exception when a header contains CR or LF. However, any user of cowlib that does not honor these options remains vulnerable.

With a CVSS score of 6.3 the vulnerability is considered moderate severity. The EPSS score is below 1%, indicating a very low probability of exploitation at present. It is not listed in the CISA KEV catalog, so no active exploitation has been reported. The attack requires an attacker to supply or influence header values constructed by the application – for example, by sending crafted requests that include untrusted input to be encoded into structured HTTP headers, which can then inject CRLF sequences and cause response splitting.