Improper Neutralization of CRLF Sequences (CWE-93) in the cow_cookie:cookie/1 function of the cowlib Erlang library permits an attacker who can control the cookie name or value fields to inject CR, LF, semicolons, commas, or tabs into a serialized Cookie header. Based on the description, it is inferred that this manipulation can result in cookie smuggling—for example, adding "; admin=1" to forge an authenticated cookie—or HTTP request header splitting, which appends unauthorized headers or a complete second request to a shared upstream proxy. The effect is a violation of confidentiality, integrity, or availability of downstream applications, potentially enabling unauthorized authentication or request tampering.

The vulnerability affects the cowlib Erlang library developed by ninenines. It is present in versions 2.9.0 and later that have not applied the encoder validation patch. Any application that uses cow_cookie:cookie/1 to construct outbound Cookie headers – such as web servers, HTTP clients, or reverse proxies relying on cowlib – should be evaluated for exposure.

The CVSS score of 2.1 labels this issue as low severity, and the EPSS score of less than 1 percent indicates a very limited likelihood of current exploitation. The vulnerability is not listed in the CISA KEV catalogue. Exploitation requires an attacker to influence the arguments passed to cow_cookie:cookie/1, typically by compromising application logic or supplying crafted user input. Because the defect resides solely in the encoder, the attack surface is constrained to outbound request construction. Nonetheless, the presence of CRLF or other delimiters can lead to authentication bypass or defacement if downstream services are not stringent about header validation.