hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Sec: Bump gun to version 2.7.0 and cowlib to version 2.21.0

Browse source 
Fixes:
  cowlib 2.20.0 - EEF-CVE-2026-43966 (MEDIUM)
    aka: CVE-2026-43966, GHSA-w4f7-4cxr-rv3c
    HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2
    https://osv.dev/vulnerability/EEF-CVE-2026-43966

  cowlib 2.20.0 - EEF-CVE-2026-43969 (LOW)
    aka: CVE-2026-43969, GHSA-g2wm-735q-3f56
    Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1
    https://osv.dev/vulnerability/EEF-CVE-2026-43969
This commit is contained in:
Phantasm 2026-10-21 11:16:24 +02:00
commit 235435fc9b
No known key found for this signature in database
GPG key ID: 2669E588BCC634C8
2 changed files with 3 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

1
changelog.d/cowlib-2.21.0.security Normal file
View file

@ -0,0 +1 @@
Update gun to version 2.7.0 and cowlib to version 2.21.0 resolving a header smuggling vulnerability