CVE-2026-43974: gun Package Vulnerability Leading to Raw Protocol Mode Exploitation
Summary
CVE-2026-43974: gun has an Unexpected Status Code or Return Value vulnerability. Affects gun versions >= 2.0.0, < 2.4.0. Fixed in 2.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The gun package is a popular HTTP client library in the Elixir ecosystem, designed for handling WebSocket and HTTP requests efficiently. It provides features such as connection management, message handling, and protocol upgrades. However, it is vulnerable to a specific issue that allows malicious servers to exploit the client by sending unsolicited protocol upgrade responses, leading to potential denial of service.
Vulnerability Detail
The vulnerability arises from the gun_http module's inability to properly validate the Upgrade and Connection headers when receiving a 101 Switching Protocols response over HTTP/1.1. This oversight allows any HTTP server to send an unsolicited 101 response, forcing the gun client into raw protocol mode. In this mode, the client loses HTTP framing, and the server can flood the client with arbitrary data, overwhelming its mailbox and memory, ultimately crashing the VM. This vulnerability affects gun versions from 2.0.0 to before 2.4.0.
How To Fix
Latest published version: 2.7.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.4.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional validation on the client-side to ignore unsolicited 101 responses. However, this is not a complete solution and should not replace updating to the patched version.
Conclusion
The gun package has a significant vulnerability (CVE-2026-43974) that can be exploited by malicious servers, leading to potential denial of service. It is crucial to update to version 2.4.0 or later to mitigate this risk. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for gun →
FAQ
CVE-2026-43974 is a vulnerability in the gun package that allows a malicious HTTP server to force the client into raw protocol mode, potentially leading to denial of service.
The vulnerability affects gun versions from 2.0.0 to before 2.4.0.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
If you cannot update the package right away, consider implementing additional validation to ignore unsolicited 101 responses as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for gun.
