CVE-2026-43973: Gun HTTP/1.1 Response Buffer Memory Exhaustion Vulnerability
Summary
CVE-2026-43973: gun HTTP/1.1 response buffer has no size limit allowing server-controlled memory exhaustion. Affects gun across 2 version ranges.
>= 1.0.0, < 2.4.0
>= 11dfe71f4b9aedaaedea2ad3b2f32fd006a8480f, < f3e7e0568b3c4cf9fa4bea79d5116e67ce76ad25
Fixed in 2.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gun is an HTTP client for the Erlang ecosystem, designed to facilitate asynchronous HTTP requests and responses. It is widely used for its simplicity and efficiency in handling HTTP communications. However, it has a vulnerability in the gun_http module that allows for uncontrolled resource consumption, specifically through unbounded HTTP/1.1 response buffering.
Vulnerability Detail
The vulnerability arises from the gun_http:handle/5 function, where incoming TCP data is accumulated into a connection's buffer without any size limit. This occurs in three clauses: the head clause, the body_chunked clause, and the body_trailer clause. If a malicious server sends a partial response that never completes, the gun connection process will continue to append data to its buffer indefinitely, leading to unbounded heap growth. This can result in a node-wide out-of-memory crash, as BEAM does not impose a per-process heap limit by default. The issue affects versions of Gun from 1.0.0 to before 2.4.0.
How To Fix
Minimum fixed version
2.4.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement a proxy that limits the size of incoming HTTP responses. This can help mitigate the risk of memory exhaustion until you can update to the patched version.
Conclusion
CVE-2026-43973 presents a significant risk to applications using the Gun HTTP client due to its potential for memory exhaustion. It is crucial to update to version 2.4.0 or later to mitigate this vulnerability. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for gun →
FAQ
CVE-2026-43973 is a vulnerability in the Gun HTTP client that allows for memory exhaustion due to unbounded HTTP response buffering.
If exploited, this vulnerability can lead to a node-wide out-of-memory crash, affecting the availability and performance of your application.
The vulnerability affects Gun versions from 1.0.0 to before 2.4.0.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check if your application is affected by visiting the Vulert playground at Vulert Scanner.
The CVSS score for CVE-2026-43973 is 8.7, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for gun.
