Threats affecting pkg:hex/gun

CVE-2026-43973 is a high-severity vulnerability in the ninenines gun HTTP client library affecting versions 1.0.0 up to but not including 2.4.0. The issue is due to unbounded HTTP/1.1 response buffering in the gun_http:handle/5 function, which allows a malicious server to cause uncontrolled memory consumption by sending partial HTTP responses that never complete. This can lead to exhaustion of client memory and a node-wide crash. No official patch or remediation has been documented yet.

CVE-2026-43972 is an origin validation error vulnerability in the ninenines gun HTTP/2 module (gun_http2). It allows a malicious or compromised HTTP/2 server to inject cookies scoped to arbitrary third-party domains into the client's cookie store via unvalidated PUSH_PROMISE authority headers. This violates HTTP/2 protocol requirements and can enable session fixation and potential account takeover without user interaction. The issue affects gun versions from 2.0.0 up to but not including 2.4.0.

CVE-2026-43974 is a high-severity vulnerability in the ninenines gun HTTP client (gun_http module) that allows a malicious HTTP server to force the client into raw protocol mode by sending an unsolicited 101 Switching Protocols response. This causes the client to abandon HTTP framing and accept unbounded data, potentially exhausting memory and crashing the Erlang VM. The issue affects gun versions from 2.0.0 up to but not including 2.4.0.