CVE-2026-43974
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
A vulnerability in the gun_http module of the gun library (Erlang/Elixir) allows a malicious HTTP server to force the client into raw protocol mode via an unsolicited 101 Switching Protocols response. The handle_inform/8 function does not check if the client sent an Upgrade or Connection: upgrade header in the request. After receiving a 101 response, gun switches to raw mode with no flow control, and the server can flood the client with arbitrary data, leading to memory exhaustion and VM crash.
Risk Assessment
The risk involves remote memory exhaustion of a BEAM node by a malicious HTTP server, potentially leading to node-wide crash.
Recommendation
Upgrade gun to version 2.4.0 or later, which contains the fix.
Other vulnerabilities in gun
See all- CVE-2026-43973High
A vulnerability in the gun_http module of the gun library (Erlang/Elixir) allows a malicious server to exhaust client memory via unbounded HTTP/1.1 response buffering. The handle/5 function accumulates TCP data in the connection's buffer without an upper limit when the expected terminator (e.g., \r\n\r\n) never arrives. A malicious server can send a partial response that never completes, causing continuous buffer growth and memory exhaustion of the BEAM node.
- CVE-2026-43972High
The gun library (gun_http2 module) versions 2.0.0 to 2.4.0 have an origin validation vulnerability. An unvalidated :authority header in PUSH_PROMISE frames allows cookie injection for arbitrary third-party domains, enabling session fixation and account takeover.
Original NVD description (English source)
Unexpected Status Code or Return Value vulnerability in ninenines gun (gun_http module) allows a malicious HTTP server to force the client into raw protocol mode via an unsolicited 101 Switching Protocols response. In gun_http:handle_inform/8, when a 101 Switching Protocols response is received over HTTP/1.1, the function verifies only that the Upgrade header is syntactically valid and that the stream reference is a plain reference(). It does not check whether the client ever sent an Upgrade or Connection: upgrade header on the corresponding request. Because this check is absent, any 101 response (solicited or not) causes gun to dispatch a gun_upgrade message to the caller and transition the entire connection to raw protocol mode. A malicious or compromised HTTP server can send an unsolicited 101 response to any HTTP/1.1 request, causing the gun client to abandon HTTP framing for that connection. Once in raw mode, gun_raw applies no flow control (flow=infinity) and re-arms socket active mode after every received packet, so the server can flood the client with arbitrary bytes. These are forwarded as unbounded gun_data messages to the owner process, exhausting its mailbox and BEAM memory, ultimately crashing the VM. This issue affects gun: from 2.0.0 before 2.4.0.