https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-43966.htmlhttps://patchthecve.com/cve/CVE-2026-43966.htmlWed, 14 Oct 2026 10:17:53 +0000MEDIUM 5.3: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in ninenines cowlib allows HTTP response splitting via non-VCHAR bytes in structured-fields string values. cow_http_struct_hd:escape_string/2 in cowlib only escapes \ and ", passing all otherhttps://patchthecve.com/cve/CVE-2026-43974.htmlhttps://patchthecve.com/cve/CVE-2026-43974.htmlTue, 18 Aug 2026 15:44:36 +0000HIGH 7.5: Unexpected Status Code or Return Value vulnerability in ninenines gun (gun_http module) allows a malicious HTTP server to force the client into raw protocol mode via an unsolicited 101 Switching Protocols response. In gun_http:handle_inform/8, when a 101 Switching Protocols response is received ovehttps://patchthecve.com/cve/CVE-2026-43973.htmlhttps://patchthecve.com/cve/CVE-2026-43973.htmlTue, 18 Aug 2026 15:43:43 +0000HIGH 7.5: Uncontrolled Resource Consumption vulnerability in ninenines gun (gun_http module) allows a malicious server to exhaust client memory via unbounded HTTP/1.1 response buffering. In gun_http:handle/5, three clauses accumulate incoming TCP data into the connection's buffer field using binary concatenahttps://patchthecve.com/cve/CVE-2026-43972.htmlhttps://patchthecve.com/cve/CVE-2026-43972.htmlTue, 18 Aug 2026 15:42:54 +0000HIGH 7.2: Origin Validation Error vulnerability in ninenines gun (gun_http2 module) allows cross-origin cookie injection via unvalidated HTTP/2 PUSH_PROMISE authority. In gun_http2:push_promise_frame/7, the :authority pseudo-header from an incoming PUSH_PROMISE frame is stored verbatim into the promised strehttps://patchthecve.com/cve/CVE-2026-7790.htmlhttps://patchthecve.com/cve/CVE-2026-7790.htmlMon, 26 Oct 2026 18:10:00 +0000HIGH 7.5: Uncontrolled Resource Consumption vulnerability in ninenines cowlib (cow_http_te module) allows Excessive Allocation. The chunked transfer-encoding parser in cow_http_te accepts an unbounded number of hex digits in the chunk-size field. Each digit causes a bignum multiplication (Len * 16 + digit), https://patchthecve.com/cve/CVE-2026-43969.htmlhttps://patchthecve.com/cve/CVE-2026-43969.htmlMon, 26 Oct 2026 20:10:00 +0000LOW 3.2: Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows HTTP request splitting and cookie smuggling via unvalidated cookie name and value fields. cow_cookie:cookie/1 in cowlib builds a client-side Cookie: request header from a list of name-value pairs whttps://patchthecve.com/cve/CVE-2026-43968.htmlhttps://patchthecve.com/cve/CVE-2026-43968.htmlMon, 26 Oct 2026 18:10:00 +0000MEDIUM 4.0: Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows SSE event splitting and injection via unvalidated field values. cow_sse:event/1 in cowlib guards the id and event fields against \n but not against bare \r, and the internal prefix_lines/2 function