CVE-2026-43966 is an HTTP Request/Response Splitting vulnerability in the cowlib library used by cowboy. It arises from improper escaping of CRLF sequences in HTTP header values, allowing attackers to inject CRLF characters and split HTTP responses. This affects cowlib versions before 2.16.0 and 2.4.0. A fix is available in versions 2.16.0 and 2.4.0.