hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Sec: Bump cowlib to 2.20.0 and gun to 2.6.0

Browse source 
Fixes:
  cowlib:
    EEF-CVE-2026-43971 (MEDIUM)
    aka: CVE-2026-43971
    Link Header Directive Smuggling via Unescaped target/rel/Attribute Keys in cow_link:link/1
    https://osv.dev/vulnerability/EEF-CVE-2026-43971

    EEF-CVE-2026-43966 (MEDIUM)
    aka: CVE-2026-43966, GHSA-w4f7-4cxr-rv3c
    HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2
    https://osv.dev/vulnerability/EEF-CVE-2026-43966

    EEF-CVE-2026-43969 (LOW)
    aka: CVE-2026-43969, GHSA-g2wm-735q-3f56
    Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1
    https://osv.dev/vulnerability/EEF-CVE-2026-43969
  gun:
    GHSA-w4f7-4cxr-rv3c (MEDIUM)
    aka: CVE-2026-43966, EEF-CVE-2026-43966
    cowboy and gun affected by an HTTP Request/Response Splitting vulnerability
    https://osv.dev/vulnerability/GHSA-w4f7-4cxr-rv3c
This commit is contained in:
Phantasm 2026-09-08 21:38:55 +02:00
commit 92b8fba3e3
No known key found for this signature in database
GPG key ID: 2669E588BCC634C8
4 changed files with 6 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

1
changelog.d/cowlib-2.20.0.security Normal file
View file

@ -0,0 +1 @@
Update cowlib to version 2.20.0 which fixes HTTP splitting and header smuggling/injection vulnerabilities

1
changelog.d/gun-2.6.0.security Normal file
View file

@ -0,0 +1 @@
Update gun to version 2.6.0 which fixes an HTTP request/response smuggling vulnerability