The vulnerability stems from the cow_cookie:cookie/1 function in the cowlib Erlang library, which creates a Cookie request header from a list of name‑value pairs without validating the input. An attacker who can supply cookie names or values that contain control characters such as CR, LF, semicolon, comma or tab can inject arbitrary header delimiters or cookie attributes. This enables cookie smuggling—where a forged cookie like "; admin=1" is interpreted as a real cookie by the server—and HTTP request splitting, allowing a malicious person to append extra headers or even an entire second request to a shared upstream proxy. While the severity is low (CVSS 2.1), the impact is a compromise of authentication or request integrity when the vulnerable library is used in client‑side HTTP requests.

The issue affects the ninenines cowlib Erlang library starting at version 2.9.0 and later releases that have not applied the fix. Users running this or newer versions are at risk. The vulnerability is tied to the cow_cookie module and may impact any application that builds outbound HTTP headers using cowlib without additional validation.

The CVSS score of 2.1 reflects a low likelihood of widespread exploitation, and the EPSS score is not available, suggesting limited current attack traffic. The vulnerability is listed in no KEV catalog. Exploitation requires the attacker to influence the arguments passed to cow_cookie:cookie/1, which typically means compromising the application logic or providing crafted inputs to a user‑controlled field that is forwarded to this function. Because the encoder is the only component lacking validation, the attack surface is limited to the construction phase of outgoing HTTP requests. While the risk remains low, the potential for cookie smuggling or request splitting can lead to authentication bypass or request tampering if the downstream server does not implement strict header validation.