pleroma/changelog.d/cowlib-2.21.0.security at 932d1b6f94f0d6cebbb3a01d32fbef9fad6c96ed - hj/pleroma - Forgejo

hj/pleroma

Phantasm 235435fc9b

Sec: Bump gun to version 2.7.0 and cowlib to version 2.21.0

Fixes:
  cowlib 2.20.0 - EEF-CVE-2026-43966 (MEDIUM)
    aka: CVE-2026-43966, GHSA-w4f7-4cxr-rv3c
    HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2
    https://osv.dev/vulnerability/EEF-CVE-2026-43966

  cowlib 2.20.0 - EEF-CVE-2026-43969 (LOW)
    aka: CVE-2026-43969, GHSA-g2wm-735q-3f56
    Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1
    https://osv.dev/vulnerability/EEF-CVE-2026-43969

2026-10-21 11:27:55 +02:00

1 line

100 B

Text

Raw Blame History

Update gun to version 2.7.0 and cowlib to version 2.21.0 resolving a header smuggling vulnerability