Quick answers
- Is CVE-2026-43973 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-43973 being exploited in the wild.
- How severe is CVE-2026-43973?
- High severity, with a CVSS score of 8.7, published 8 June 2026.
- Which products and versions are affected?
- Nine Nines Gun 1.0.0 to 2.3.0.
- Is there a fix for CVE-2026-43973?
- A patch was published on 2026-06-04: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-43973 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-43973?
- Check whether you run Nine Nines Gun at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The gun_http:handle/5 function in the Gun HTTP client fails to implement upper-bound checks when accumulating TCP data into the connection's buffer. Specifically, the head, body_chunked, and body_trailer clauses use binary concatenation to store incoming data while waiting for HTTP terminators (like \r\n\r\n). A malicious server can exploit this by sending a partial response followed by an infinite stream of bytes without the expected terminator. Because the BEAM virtual machine does not impose per-process heap limits by default, this results in unbounded memory growth and a node-wide out-of-memory (OOM) crash. The issue is fixed in version 2.4.0 by introducing max_header_block_size and max_trailer_block_size options.
Affected products
- ninenines gun >= 1.0.0, < 2.4.0
Identifiers
- CVE-2026-43973
- GHSA-r53j-fjj5-mv77
Timeline
- 2026-06-04: patched: Fix committed to repository
- 2026-06-08: disclosed: Initial advisory publication
- 2026-07-29: advisory: Advisory updated and reviewed by GitHub