Improper Neutralization of CRLF Sequences (CWE‑93) in the cow_cookie:cookie/1 function of the cowlib Erlang library allows an attacker who can control cookie names or values to inject characters such as semicolons, commas, carriage return, line feed, or tab into a serialized Cookie header. This injection is possible because the encoder does not validate either field before building the header. An attacker can therefore perform cookie smuggling by adding phantom cookies (e.g., "; admin=1") or execute HTTP request header splitting by inserting CRLF sequences that append unauthorized headers or a second request to a shared proxy, potentially leading to authentication bypass or request tampering.

The vulnerability affects the cowlib Erlang library developed by ninenines. It is present in versions 2.9.0 through 2.20.x, which do not include the encoder validation patch. Any application that uses cow_cookie:cookie/1 to construct outbound Cookie headers—such as web servers, HTTP clients, or reverse proxies relying on cowlib—should be evaluated for exposure.

The CVSS score of 2.1 labels this issue as low severity, and the EPSS score of less than 1 percent indicates a very limited likelihood of current exploitation. The vulnerability is not listed in the CISA KEV catalogue. Exploitation requires an attacker to influence the arguments passed to cow_cookie:cookie/1, typically by compromising application logic or supplying crafted user input. Because the defect resides solely in the encoder, the attack surface is constrained to outbound request construction. Nonetheless, the presence of CRLF or other delimiters can lead to authentication bypass or defacement if downstream services are not stringent about header validation.