CVE-2026-43972
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The gun library (gun_http2 module) versions 2.0.0 to 2.4.0 have an origin validation vulnerability. An unvalidated :authority header in PUSH_PROMISE frames allows cookie injection for arbitrary third-party domains, enabling session fixation and account takeover.
Risk Assessment
A malicious HTTP/2 server can inject cookies for any domain into the client's cookie store, potentially leading to session hijacking and account takeover.
Recommendation
Update the gun library to version 2.4.0 or later.
Other vulnerabilities in gun
See all- CVE-2026-43974High
A vulnerability in the gun_http module of the gun library (Erlang/Elixir) allows a malicious HTTP server to force the client into raw protocol mode via an unsolicited 101 Switching Protocols response. The handle_inform/8 function does not check if the client sent an Upgrade or Connection: upgrade header in the request. After receiving a 101 response, gun switches to raw mode with no flow control, and the server can flood the client with arbitrary data, leading to memory exhaustion and VM crash.
- CVE-2026-43973High
A vulnerability in the gun_http module of the gun library (Erlang/Elixir) allows a malicious server to exhaust client memory via unbounded HTTP/1.1 response buffering. The handle/5 function accumulates TCP data in the connection's buffer without an upper limit when the expected terminator (e.g., \r\n\r\n) never arrives. A malicious server can send a partial response that never completes, causing continuous buffer growth and memory exhaustion of the BEAM node.
Original NVD description (English source)
Origin Validation Error vulnerability in ninenines gun (gun_http2 module) allows cross-origin cookie injection via unvalidated HTTP/2 PUSH_PROMISE authority. In gun_http2:push_promise_frame/7, the :authority pseudo-header from an incoming PUSH_PROMISE frame is stored verbatim into the promised stream record without checking that it matches the connection's origin. When gun_http2:headers_frame/9 later processes the response headers for the promised stream, it calls gun_cookies:set_cookie_header/7 with the unvalidated server-supplied authority before any status branching and before user code can act. This violates RFC 7540 §10.6 / RFC 9113 §8.4, which require receivers to treat as a protocol error any push for a resource the server is not authoritative for. A malicious or compromised HTTP/2 server can plant cookies scoped to arbitrary third-party domains into the client's shared cookie store. This enables session fixation attacks against those domains and, if the planted cookie overrides a legitimate session token, may result in account takeover. No user interaction beyond making a normal HTTP/2 request to the attacker-controlled server is required. This issue affects gun: from 2.0.0 before 2.4.0.