Vulnerabilities

TI-2026-32018 CVE-2026-43973 · GHSA-r53j-fjj5-mv77

gun HTTP/1.1 response buffer has no size limit allowing server-controlled memory exhaustion

MEDIUM 44

Uncontrolled Resource Consumption vulnerability in ninenines gun (gun_http module) allows a malicious server to exhaust client memory via unbounded HTTP/1.1 response buffering.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00482 Published 2026-06-08 Fixed in 2.4.0 CWE-770

TI-2026-32017 CVE-2026-43972 · GHSA-36w4-95hv-5vwg

gun HTTP/2 PUSH_PROMISE authority not validated against connection origin allows cross-origin cookie injection

LOW 27

Origin Validation Error vulnerability in ninenines gun (gun_http2 module) allows cross-origin cookie injection via unvalidated HTTP/2 PUSH_PROMISE authority.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00168 Published 2026-06-08 Fixed in 2.4.0 CWE-346

TI-2026-32019 CVE-2026-43974 · GHSA-2j82-37xg-f9wp

gun HTTP/1.1 client accepts unsolicited 101 Switching Protocols response allowing server-driven protocol hijack and OOM

MEDIUM 44

Unexpected Status Code or Return Value vulnerability in ninenines gun (gun_http module) allows a malicious HTTP server to force the client into raw protocol mode via an unsolicited 101 Switching Protocols response.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00482 Published 2026-06-08 Fixed in 2.4.0 CWE-841

Vulnerabilities

Filters

gun HTTP/1.1 response buffer has no size limit allowing server-controlled memory exhaustion

gun HTTP/2 PUSH_PROMISE authority not validated against connection origin allows cross-origin cookie injection

gun HTTP/1.1 client accepts unsolicited 101 Switching Protocols response allowing server-driven protocol hijack and OOM