Hi,

The following vulnerability was published for erlang-cowlib.

CVE-2026-43971[0]:
| Improper Encoding or Escaping of Output vulnerability in ninenines
| cowlib allows Link header directive smuggling via unescaped special
| characters in cow_link:link/1.  cow_link:do_link/1 in cowlib
| interpolates the target URI, rel value, and attribute keys directly
| into the serialized Link: header value without escaping or token-
| grammar validation. A > byte in target prematurely closes the URI
| slot, allowing an attacker to append additional link entries with
| attacker-chosen rel directives. A " or \ in rel escapes the quoted
| string and opens new parameters. Any byte — including whitespace, =,
| and " — in an attribute key is emitted verbatim. Because browsers
| act on Link: directives such as rel="preconnect", rel="preload", and
| rel="prerender", an attacker who can influence these fields in an
| application that round-trips parsed Link headers through
| cow_link:link/1 can force victim browsers to make out-of-band
| connections to attacker-controlled origins.  This issue affects
| cowlib: from 2.9.0 onward.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-43971
https://www.cve.org/CVERecord?id=CVE-2026-43971
[1] https://cna.erlef.org/cves/CVE-2026-43971.html
[2] https://osv.dev/vulnerability/EEF-CVE-2026-43971
[3] https://github.com/ninenines/cowlib/commit/89da27ee4c241f5d649ba7d9b7f2188918af6cea

Regards,
Salvatore