Executive brief
Gun is an HTTP client for Erlang/Elixir used to connect to web services. A vulnerability allows a malicious server to send an endless stream of data that the client will store in memory without limit. This can cause the entire application to run out of memory and crash, leading to a complete service outage.
Technical details
The gun_http:handle/5 function in the Gun HTTP client fails to implement upper-bound checks when accumulating TCP data into the connection's buffer. Specifically, the head, body_chunked, and body_trailer clauses use binary concatenation to store incoming data while waiting for HTTP terminators (like \r\n\r\n). A malicious server can exploit this by sending a partial response followed by an infinite stream of bytes without the expected terminator. Because the BEAM virtual machine does not impose per-process heap limits by default, this results in unbounded memory growth and a node-wide out-of-memory (OOM) crash. The issue is fixed in version 2.4.0 by introducing max_header_block_size and max_trailer_block_size options.
Affected products
- ninenines gun >= 1.0.0, < 2.4.0
Timeline
- 2026-06-04: patched: Fix committed to repository
- 2026-06-08: disclosed: Initial advisory publication
- 2026-07-29: advisory: Advisory updated and reviewed by GitHub