{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-43968",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-43968",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-05-11T18:06:42.881Z",
    "updatedAt": "2026-05-12T12:11:43.388Z",
    "importedAt": "2026-10-24T01:58:14.884Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "CR Injection in SSE Encoder Enables Event Splitting via cow_sse:event/1",
      "summary": "Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows SSE event splitting and injection via unvalidated field values.\n\ncow_sse:event/1 in cowlib guards the id and event fields against \\n but not against bare \\r, and the internal prefix_lines/2 function used for data and comment fields splits only on \\n. Because the SSE specification requires decoders to treat \\r\\n, \\r, and \\n as equivalent line terminators, an attacker who controls any of these fields can inject additional SSE lines and forge a complete event with an arbitrary event type and data payload on the receiving end. In typical deployments where browser EventSource clients or other SSE consumers dispatch on event.type and render event.data, this enables event splitting, client-side logic manipulation, and stored-XSS-equivalent behaviour when event data is inserted into the DOM.\n\nThis issue affects cowlib from 2.6.0 before 2.16.1.",
      "affected": [
        {
          "vendor": "ninenines",
          "product": "cowlib",
          "packageName": "cowlib",
          "collectionURL": "https://repo.hex.pm",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "2.6.0",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "2.16.1"
            }
          ]
        },
        {
          "vendor": "ninenines",
          "product": "cowlib",
          "packageName": "ninenines/cowlib",
          "collectionURL": "https://github.com",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "93b2b897cde238506c803faad4d1602d79dba7c9",
              "status": "affected",
              "versionType": "git",
              "lessThan": "6165fc40efa159ba1cceee7e7981e790acba5d9c"
            }
          ]
        }
      ]
    }
  }
}