Back Linuxsecurity

Fedora 44 erlang-cowlib Major Cross-Origin Session Fixation CVE-2026

Linuxsecurity •LinuxSecurity Advisories • June 21, 2026

* Fri Jun 12 2026 Peter Lemenkov - 2.17.1-1 - Cowlib ver. 2.17.1 * Wed Jun 10 2026 Peter Lemenkov - 2.17.0-1 - Cowlib ver. 2.17.0

[ 1 ] Bug #2486315 - erlang-cowlib-2.17.0 is available [ 2 ] Bug #2486350 - erlang-gun-2.4.0 is available [ 3 ] Bug #2486422 - CVE-2026-43972 erlang-gun: Gun: Cross-origin cookie injection leading to session fixation and account takeover. [fedora-all] [ 4 ] Bug #2486423 - CVE-2026-43974 erlang-gun: gun: Denial of Service via unsolicited 101 Switching Protocols response [fedora-all] [ 5 ] Bug #2486424 - CVE-2026-43973 erlang-gun: gun: Denial of Service via unbounded HTTP/1.1 response buffering [fedora-all] [ 6 ] Bug #2487823 - erlang-cowboy-2.16.1 is available [ 7 ] Bug #2487824 - erlang-cowlib-2.17.1 is ...

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-c17ea7a74d' at the command line. For more information, refer to the dnf documentation available at

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Denial of Service Vulnerabilities in Fedora Erlang Packages Addressed Multiple critical vulnerabilities have been identified in Fedora's Erlang packages, specifically affecting erlang-gun and erlang-cowboy. CVE-2026-43972 involves a cross-origin cookie injection leading to session fixation and account takeover, while CVE-2026-43974 and CVE-2026-43973 address Denial of Service (DoS) vulnerabilities. The vulnerabilities were published on June 8, 2026, and impact Fedora 43 and 44 users. Users are urged to update their systems immediately to mitigate these risks. The updates can be installed using the 'dnf' update program. The vulnerabilities were reported by Peter Lemenkov, a Fedora maintainer. The affected versions include erlang-gun 2.4.0 and 2.4.1, and erlang-cowboy 2.16.0 and 2.16.1. Current advisories emphasize the urgency of applying the patches. 6 sources 73

Extracted Entities

Fedora 44 erlang-cowlib Major Cross-Origin Session Fixation CVE-2026

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (3)

Platforms (1)