CVE-2026-43974: gun HTTP/1.1 Client Protocol Hijack and OOM Vulnerability
Summary
CVE-2026-43974: Unexpected Status Code or Return Value vulnerability in ninenines gun (gun_http module) allows a malicious HTTP server to force the client into raw protocol mode via an unsolicited 101 Switching Protocols response. Affects gun across 2 version ranges.
>= 2.0.0, < 2.4.0
>= a3c2edbb8c807717e2f10520c6cf1e77a62eab2e, < 5b48068c29ce5e112cb149b5857c7d4dc319a81b
Fixed in 2.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'gun' package is an HTTP client library designed for Erlang, facilitating communication between clients and servers using the HTTP/1.1 protocol. It is known for its lightweight design and ability to handle real-time data streams efficiently. However, it is susceptible to vulnerabilities that can compromise its operation, particularly in how it manages protocol upgrades and responses from servers.
Vulnerability Detail
The vulnerability arises from the gun_http module's failure to validate unsolicited 101 Switching Protocols responses from servers. When a malicious server sends this response, the gun client transitions to raw protocol mode without verifying if the client requested an upgrade. This allows the server to flood the client with arbitrary data, leading to unbounded memory consumption and potentially crashing the Erlang VM. The vulnerability affects gun versions from 2.0.0 to before 2.4.0, with a CVSS score of 8.7 indicating a high severity.
How To Fix
Latest published version: 2.7.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.4.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement checks on the server-side to avoid sending unsolicited 101 Switching Protocols responses. Additionally, consider using a firewall or proxy to filter out such responses before they reach the gun client.
Conclusion
In summary, CVE-2026-43974 represents a significant vulnerability in the gun HTTP client, allowing for protocol hijacking and potential crashes due to memory exhaustion. It is crucial for users of affected versions to update to the patched version to mitigate risks.
See every vulnerability recorded for gun →
FAQ
CVE-2026-43974 is a vulnerability in the gun HTTP client that allows a malicious server to hijack the protocol and potentially crash the client.
If your application uses an affected version of gun, it may be susceptible to memory exhaustion and crashes due to uncontrolled data flooding from a malicious server.
The vulnerability affects gun versions from 2.0.0 to before 2.4.0.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for gun.
