ninenines

Records14All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high8CVSS 7.0–8.9

Exploited now

ninenines records in CISA KEV

No ninenines vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Cowlib 4 records MEDIUM Gun 3 records MEDIUM

Records

3 records in Gun · all components

TI-2026-32019 CVE-2026-43974 · GHSA-2j82-37xg-f9wp

gun HTTP/1.1 client accepts unsolicited 101 Switching Protocols response allowing server-driven protocol hijack and OOM

MEDIUM 44

Unexpected Status Code or Return Value vulnerability in ninenines gun (gun_http module) allows a malicious HTTP server to force the client into raw protocol mode via an unsolicited 101 Switching Protocols response.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00482 Published 2026-06-08 Fixed in 2.4.0 CWE-841

TI-2026-32018 CVE-2026-43973 · GHSA-r53j-fjj5-mv77

gun HTTP/1.1 response buffer has no size limit allowing server-controlled memory exhaustion

MEDIUM 44

Uncontrolled Resource Consumption vulnerability in ninenines gun (gun_http module) allows a malicious server to exhaust client memory via unbounded HTTP/1.1 response buffering.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00482 Published 2026-06-08 Fixed in 2.4.0 CWE-770

TI-2026-32017 CVE-2026-43972 · GHSA-36w4-95hv-5vwg

gun HTTP/2 PUSH_PROMISE authority not validated against connection origin allows cross-origin cookie injection

LOW 27

Origin Validation Error vulnerability in ninenines gun (gun_http2 module) allows cross-origin cookie injection via unvalidated HTTP/2 PUSH_PROMISE authority.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00168 Published 2026-06-08 Fixed in 2.4.0 CWE-346

Open these records in search →

Critical	0
High	8
Medium	5
Low	1
No CVSS	0