gun vulnerabilities

3 known vulnerabilities in gun from Ninenines. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  gun: Improper Enforcement of Behavioral Workflow

  CVE-2026-43974Jun 8, 2026Ninenines

  Unexpected Status Code or Return Value vulnerability in ninenines gun (gun_http module) allows a malicious HTTP server to force the client into raw protocol mode via an unsolicited 101 Switching Protocols response. In gun_http:handle_inform/8, when a 101 Switc

• 7.5 High severity

  gun: Allocation of Resources Without Limits or Throttling

  CVE-2026-43973Jun 8, 2026Ninenines

  Uncontrolled Resource Consumption vulnerability in ninenines gun (gun_http module) allows a malicious server to exhaust client memory via unbounded HTTP/1.1 response buffering. In gun_http:handle/5, three clauses accumulate incoming TCP data into the connectio

• 7.2 High severity

  gun: Origin Validation Error

  CVE-2026-43972Jun 8, 2026Ninenines

  Origin Validation Error vulnerability in ninenines gun (gun_http2 module) allows cross-origin cookie injection via unvalidated HTTP/2 PUSH_PROMISE authority. In gun_http2:push_promise_frame/7, the :authority pseudo-header from an incoming PUSH_PROMISE frame is