The vulnerability arises because the gun_http2 module does not validate the :authority pseudo-header in incoming PUSH_PROMISE frames against the connection's origin. The unvalidated authority is stored and later used to set cookies before any status checks or user code intervention, violating RFC 7540 §10.6 and RFC 9113 §8.4. This flaw allows an attacker controlling an HTTP/2 server to plant cookies for arbitrary domains in the client's shared cookie store, enabling session fixation attacks and possible account takeover if the malicious cookie overrides legitimate session tokens. The affected versions are gun from 2.0.0 before 2.4.0.

An attacker controlling or compromising an HTTP/2 server can inject cookies for arbitrary third-party domains into a client's cookie store. This can lead to session fixation attacks and potentially account takeover if the malicious cookie replaces a legitimate session token. No user interaction beyond making a normal HTTP/2 request to the attacker-controlled server is required. The vulnerability violates HTTP/2 protocol specifications for origin validation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, avoid using vulnerable versions of gun with untrusted HTTP/2 servers or disable HTTP/2 PUSH_PROMISE handling if possible.