MEDIUM4.0CVE-2026-43968ninenines cowlib: Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability allows SSE event splitting and injection via unvalidated field values
>= 2.6.0, < 2.16.1
LOW3.2CVE-2026-43969cowlib: Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1
>= 2.9.0, <= 2.16.1
—cowlib: Decompression Bomb in cow_spdy:inflate/2 Allows Memory Exhaustion via Crafted SPDY Frame