The vulnerability in cowlib 2.9.0 arises from the cow_cookie:cookie/1 function building a client-side Cookie header from name-value pairs without validating the input fields. This lack of validation permits injection of CRLF and other special characters, enabling HTTP request splitting and cookie smuggling attacks. The decoder side and setcookie/3 functions already implement validation to reject these characters, but the encoder side is missing this check. This flaw is classified under CWE-93 (Improper Neutralization of CRLF Sequences).

Exploitation of this vulnerability could allow an attacker to perform HTTP request header splitting and cookie smuggling by injecting malicious characters into cookie names or values. This may result in the injection of phantom cookies or arbitrary HTTP headers, potentially affecting the behavior of upstream proxies or servers processing the requests. The CVSS 4.0 score is 2.1, indicating a low severity impact with limited attack vector and complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid passing untrusted input to the cow_cookie:cookie/1 function or implement additional input validation to sanitize cookie names and values before encoding. Monitoring vendor channels for updates is recommended.