gun vulnerabilities

A vulnerability in the gun_http module of the gun library (Erlang/Elixir) allows a malicious HTTP server to force the client into raw protocol mode via an unsolicited 101 Switching Protocols response. The handle_inform/8 function does not check if the client sent an Upgrade or Connection: upgrade header in the request. After receiving a 101 response, gun switches to raw mode with no flow control, and the server can flood the client with arbitrary data, leading to memory exhaustion and VM crash.

A vulnerability in the gun_http module of the gun library (Erlang/Elixir) allows a malicious server to exhaust client memory via unbounded HTTP/1.1 response buffering. The handle/5 function accumulates TCP data in the connection's buffer without an upper limit when the expected terminator (e.g., \r\n\r\n) never arrives. A malicious server can send a partial response that never completes, causing continuous buffer growth and memory exhaustion of the BEAM node.

The gun library (gun_http2 module) versions 2.0.0 to 2.4.0 have an origin validation vulnerability. An unvalidated :authority header in PUSH_PROMISE frames allows cookie injection for arbitrary third-party domains, enabling session fixation and account takeover.