Executive brief
A vulnerability exists in the Gun HTTP client library, which is used by Erlang and Elixir applications to communicate with web servers. A malicious or compromised server can send an unexpected response that forces the client to stop following standard web rules and enter a 'raw' data mode. This allows the server to flood the client with an unlimited amount of data, exhausting the system's memory and causing the entire application to crash.
Technical details
A vulnerability in the `gun_http:handle_inform/8` function of the Gun HTTP client fails to verify if an 'Upgrade' request was actually initiated by the client before processing a '101 Switching Protocols' response. When a malicious server sends an unsolicited 101 response over HTTP/1.1, Gun transitions the connection to raw protocol mode (`gun_raw`). In this state, flow control is disabled (`flow=infinity`) and the socket active mode is re-armed after every packet. An attacker can exploit this to flood the client with arbitrary bytes, exhausting the Erlang VM's (BEAM) mailbox and memory, resulting in a crash. The issue is fixed in version 2.4.0 by ensuring 101 responses are rejected with a protocol error if no upgrade was requested.
Affected products
- ninenines gun >= 2.0.0, < 2.4.0
Timeline
- 2026-05-29: patched: Fix committed to repository
- 2026-06-08: disclosed: CVE-2026-43974 published
- 2026-07-29: advisory: GitHub Advisory reviewed and updated