hj/pleroma - Forgejo

hj/pleroma

1 line

106 B

Text

Raw Normal View History

Sec: Bump cowlib to 2.20.0 and gun to 2.6.0 Fixes: cowlib: EEF-CVE-2026-43971 (MEDIUM) aka: CVE-2026-43971 Link Header Directive Smuggling via Unescaped target/rel/Attribute Keys in cow_link:link/1 https://osv.dev/vulnerability/EEF-CVE-2026-43971 EEF-CVE-2026-43966 (MEDIUM) aka: CVE-2026-43966, GHSA-w4f7-4cxr-rv3c HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2 https://osv.dev/vulnerability/EEF-CVE-2026-43966 EEF-CVE-2026-43969 (LOW) aka: CVE-2026-43969, GHSA-g2wm-735q-3f56 Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1 https://osv.dev/vulnerability/EEF-CVE-2026-43969 gun: GHSA-w4f7-4cxr-rv3c (MEDIUM) aka: CVE-2026-43966, EEF-CVE-2026-43966 cowboy and gun affected by an HTTP Request/Response Splitting vulnerability https://osv.dev/vulnerability/GHSA-w4f7-4cxr-rv3c

2026-09-08 21:38:55 +02:00

Update cowlib to version 2.20.0 which fixes HTTP splitting and header smuggling/injection vulnerabilities