CVE-2026-43974: Ninenines gun Denial of Service via unsolicited 101 Switching Protocols

CVE-2026-43974 · Severity: high · CVSS 8.7 · Published 2026-06-08

A vulnerability exists in the Gun HTTP client library, which is used by Erlang and Elixir applications to communicate with web servers. A malicious or compromised server can send an unexpected response that forces the client to stop following standard web rules and enter a 'raw' data mode. This allows the server to flood the client with an unlimited amount of data, exhausting the system's memory and causing the entire application to crash.

Technologies: Nine Nines Gun. Vendors: Nine Nines.

Quick answers

Is CVE-2026-43974 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-43974 being exploited in the wild.
How severe is CVE-2026-43974?
High severity, with a CVSS score of 8.7, published 8 June 2026.
Which products and versions are affected?
Nine Nines Gun >= 2.0.0, < 2.4.0.
Is there a fix for CVE-2026-43974?
A patch was published on 2026-05-29: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-43974 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-43974?
Check whether you run Nine Nines Gun at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in the `gun_http:handle_inform/8` function of the Gun HTTP client fails to verify if an 'Upgrade' request was actually initiated by the client before processing a '101 Switching Protocols' response. When a malicious server sends an unsolicited 101 response over HTTP/1.1, Gun transitions the connection to raw protocol mode (`gun_raw`). In this state, flow control is disabled (`flow=infinity`) and the socket active mode is re-armed after every packet. An attacker can exploit this to flood the client with arbitrary bytes, exhausting the Erlang VM's (BEAM) mailbox and memory, resulting in a crash. The issue is fixed in version 2.4.0 by ensuring 101 responses are rejected with a protocol error if no upgrade was requested.

Affected products

  • ninenines gun >= 2.0.0, < 2.4.0

Identifiers

  • CVE-2026-43974
  • GHSA-2j82-37xg-f9wp

Timeline

  • 2026-05-29: patched: Fix committed to repository
  • 2026-06-08: disclosed: CVE-2026-43974 published
  • 2026-07-29: advisory: GitHub Advisory reviewed and updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.