hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Sec: Bump cowlib to 2.20.0 and gun to 2.6.0

Browse source 
Fixes:
  cowlib:
    EEF-CVE-2026-43971 (MEDIUM)
    aka: CVE-2026-43971
    Link Header Directive Smuggling via Unescaped target/rel/Attribute Keys in cow_link:link/1
    https://osv.dev/vulnerability/EEF-CVE-2026-43971

    EEF-CVE-2026-43966 (MEDIUM)
    aka: CVE-2026-43966, GHSA-w4f7-4cxr-rv3c
    HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2
    https://osv.dev/vulnerability/EEF-CVE-2026-43966

    EEF-CVE-2026-43969 (LOW)
    aka: CVE-2026-43969, GHSA-g2wm-735q-3f56
    Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1
    https://osv.dev/vulnerability/EEF-CVE-2026-43969
  gun:
    GHSA-w4f7-4cxr-rv3c (MEDIUM)
    aka: CVE-2026-43966, EEF-CVE-2026-43966
    cowboy and gun affected by an HTTP Request/Response Splitting vulnerability
    https://osv.dev/vulnerability/GHSA-w4f7-4cxr-rv3c
This commit is contained in:
Phantasm 2026-09-08 21:38:55 +02:00
commit 92b8fba3e3
No known key found for this signature in database
GPG key ID: 2669E588BCC634C8
4 changed files with 6 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

4
mix.exs
View file

@ -154,8 +154,8 @@ defmodule Pleroma.Mixfile do
{:cachex, "~> 3.6"},
{:tesla, "~> 1.20.0"},
{:castore, "~> 1.0"},
{:cowlib, "~> 2.17.1"},
{:gun, "~> 2.4.1"},
{:cowlib, "~> 2.20"},
{:gun, "~> 2.6"},
{:finch, "~> 0.20"},
{:jason, "~> 1.4"},
{:mogrify, "~> 0.9.3", override: true},