# CVE-2026-43972: ninenines gun cross-origin cookie injection in gun_http2

Source: https://junglewise.ai/threats/cve-2026-43972-ninenines-gun-cross-origin-cookie-injection-in-gun-http2  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-08. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-43972 · Severity: medium · CVSS 6.3 · Published 2026-06-08

Gun is an HTTP client library for Erlang/Elixir applications. A vulnerability in its HTTP/2 implementation allows a malicious server to inject cookies for unrelated third-party websites into the client's cookie store. This could allow an attacker to hijack user accounts or perform session fixation attacks on other services the application interacts with.

Technologies: [Nine Nines Gun](https://junglewise.ai/threats/technologies/gun). Vendors: [Nine Nines](https://junglewise.ai/threats/vendors/nine-nines).

## Quick answers

**Is CVE-2026-43972 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-43972 being exploited in the wild.

**How severe is CVE-2026-43972?** Medium severity, with a CVSS score of 6.3, published 8 June 2026.

**Which products and versions are affected?** Nine Nines Gun >= 2.0.0, < 2.4.0.

**Is there a fix for CVE-2026-43972?** A patch was published on 2026-07-29: GitHub advisory updated with patch details Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-43972 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-43972?** Check whether you run Nine Nines Gun at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the gun_http2:push_promise_frame/7 function, where the :authority pseudo-header from an incoming PUSH_PROMISE frame is stored without verifying it matches the connection's origin. When gun_http2:headers_frame/9 subsequently processes response headers, it calls gun_cookies:set_cookie_header/7 using this unvalidated authority. This behavior violates RFC 9113 §8.4, which requires clients to reject pushes for resources the server is not authoritative for. An attacker-controlled HTTP/2 server can exploit this to plant cookies for arbitrary domains in the client's shared cookie store, facilitating session fixation or account takeover. The issue is fixed in version 2.4.0.

## Affected products

- ninenines gun >= 2.0.0, < 2.4.0

## Identifiers

- CVE-2026-43972
- GHSA-36w4-95hv-5vwg

## Timeline

- 2026-06-08: disclosed
- 2026-06-08: advisory
- 2026-07-29: patched: GitHub advisory updated with patch details

## References

- [https://github.com/ninenines/gun/commit/567863ff53802fed21c3b3f25812db7f7ae29676](https://github.com/ninenines/gun/commit/567863ff53802fed21c3b3f25812db7f7ae29676)
- [https://cna.erlef.org/cves/CVE-2026-43972.html](https://cna.erlef.org/cves/CVE-2026-43972.html)

## Related threats

- [Ninenines gun Denial of Service via unsolicited 101 Switching Protocols](https://junglewise.ai/threats/cve-2026-43974-ninenines-gun-denial-of-service-via-unsolicited-101-switching)
- [ninenines gun uncontrolled resource consumption in gun_http](https://junglewise.ai/threats/cve-2026-43973-ninenines-gun-uncontrolled-resource-consumption-in-gun-http)