The vulnerability in cowlib (affecting cowboy and gun) is due to improper neutralization of CRLF sequences in HTTP headers. Specifically, the function cow_http_struct_hd:escape_string/2 escapes only backslash and double quote characters but passes other bytes verbatim, including carriage return (CR) and line feed (LF). The corresponding parser accepts only printable ASCII characters excluding backslash and double quote, creating an asymmetry. An attacker can exploit this by injecting CRLF sequences into structured HTTP header values constructed from attacker-controlled input, causing HTTP response splitting. This issue affects cowlib versions before 2.16.0.

Successful exploitation allows an attacker to inject CRLF sequences into HTTP headers, enabling HTTP response splitting. This can lead to HTTP header injection attacks, potentially allowing cache poisoning, cross-site scripting (XSS), or other HTTP response manipulation attacks. The severity is medium based on the CVSS vector provided.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is referenced, users should monitor the Microsoft Security Response Center advisory for updates. Until a fix is available, avoid using attacker-controlled input in structured HTTP header fields constructed via cow_http_struct_hd:item/1 or related functions.