This vulnerability in the ninenines gun HTTP client library (gun_http module) arises from the lack of limits on HTTP/1.1 response buffering in the gun_http:handle/5 function. When a malicious server sends partial HTTP responses that do not complete, the client continuously appends incoming TCP data to its buffer without any upper bound. This uncontrolled memory allocation can exhaust all available memory on the client system, causing a crash affecting the entire node. The vulnerability affects gun versions from 1.0.0 up to but not including 2.4.0. There is currently no official patch or remediation available.

A malicious server can exploit this vulnerability to cause a denial of service on the client by exhausting its memory resources. This leads to a node-wide crash, disrupting all operations relying on the gun HTTP client library. The impact is high severity due to the potential for complete service disruption without requiring any privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider mitigating exposure by avoiding untrusted or malicious servers or implementing external controls to limit response sizes. Monitor vendor channels for updates on patches or official mitigations.