CVE-2026-43974: CWE-841 Improper Enforcement of Behavioral Workflow in ninenines gun
CVE-2026-43974 is a high-severity vulnerability in the ninenines gun HTTP client (gun_http module) that allows a malicious HTTP server to force the client into raw protocol mode by sending an unsolicited 101 Switching Protocols response. This causes the client to abandon HTTP framing and accept unbounded data, potentially exhausting memory and crashing the Erlang VM. The issue affects gun versions from 2.0.0 up to but not including 2.4.0.
AI Analysis
Technical Summary
The vulnerability arises because gun_http:handle_inform/8 does not verify whether the client requested an Upgrade or Connection: upgrade header before accepting a 101 Switching Protocols response. Any unsolicited 101 response causes gun to switch to raw protocol mode, where no flow control is applied and socket active mode is re-armed after every packet. A malicious server can exploit this to flood the client with arbitrary data, leading to mailbox exhaustion and VM crash. This affects gun versions >=2.0.0 <2.4.0.
Potential Impact
A malicious or compromised HTTP server can send unsolicited 101 Switching Protocols responses to force the gun client into raw protocol mode. This disables flow control and allows the server to flood the client with arbitrary data, which is forwarded as unbounded messages to the owning process. The resulting mailbox and memory exhaustion can crash the Erlang VM, causing denial of service.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using vulnerable versions or mitigate exposure to untrusted HTTP servers. No official fix or temporary workaround is currently documented.
CVE-2026-43974: CWE-841 Improper Enforcement of Behavioral Workflow in ninenines gun
Description
CVE-2026-43974 is a high-severity vulnerability in the ninenines gun HTTP client (gun_http module) that allows a malicious HTTP server to force the client into raw protocol mode by sending an unsolicited 101 Switching Protocols response. This causes the client to abandon HTTP framing and accept unbounded data, potentially exhausting memory and crashing the Erlang VM. The issue affects gun versions from 2.0.0 up to but not including 2.4.0.
CVSS v4.0
Score 8.7high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability arises because gun_http:handle_inform/8 does not verify whether the client requested an Upgrade or Connection: upgrade header before accepting a 101 Switching Protocols response. Any unsolicited 101 response causes gun to switch to raw protocol mode, where no flow control is applied and socket active mode is re-armed after every packet. A malicious server can exploit this to flood the client with arbitrary data, leading to mailbox exhaustion and VM crash. This affects gun versions >=2.0.0 <2.4.0.
Potential Impact
A malicious or compromised HTTP server can send unsolicited 101 Switching Protocols responses to force the gun client into raw protocol mode. This disables flow control and allows the server to flood the client with arbitrary data, which is forwarded as unbounded messages to the owning process. The resulting mailbox and memory exhaustion can crash the Erlang VM, causing denial of service.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using vulnerable versions or mitigate exposure to untrusted HTTP servers. No official fix or temporary workaround is currently documented.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- EEF
- Date Reserved
- 2026-05-04T18:23:25.574Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a26d2d1e29bf47b50f2165c
Added to database: 06/08/2026, 14:33:53 UTC
Last enriched: 07/30/2026, 07:23:30 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 80
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.