The vulnerability in ninenines gun (gun_http module) involves uncontrolled resource consumption due to unbounded HTTP/1.1 response buffering. Specifically, in the gun_http:handle/5 function, incoming TCP data is appended to a buffer without any upper limit until expected HTTP terminators (header or body chunk boundaries) are found. If a malicious server sends a partial response that never completes these terminators, the buffer grows indefinitely. Because the BEAM virtual machine does not impose per-process heap limits by default, this can cause the client process to consume all available memory, resulting in a node-wide out-of-memory crash. This affects gun versions from 1.0.0 up to but not including 2.4.0.

A malicious or compromised server can exploit this vulnerability by sending a crafted HTTP response that never completes, causing the client to allocate memory without limits. This can lead to exhaustion of all available memory on the node running the gun client, resulting in a denial-of-service condition via a node-wide crash. There is no indication of privilege escalation or data disclosure from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting exposure to untrusted servers or implementing external resource limits on the BEAM processes running gun clients to mitigate potential memory exhaustion. Monitor vendor channels for updates regarding patches or official mitigations.