# CVE-2026-43974: Ninenines gun Denial of Service via unsolicited 101 Switching Protocols

Source: https://junglewise.ai/threats/cve-2026-43974-ninenines-gun-denial-of-service-via-unsolicited-101-switching  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-08. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-43974 · Severity: high · CVSS 8.7 · Published 2026-06-08

A vulnerability exists in the Gun HTTP client library, which is used by Erlang and Elixir applications to communicate with web servers. A malicious or compromised server can send an unexpected response that forces the client to stop following standard web rules and enter a 'raw' data mode. This allows the server to flood the client with an unlimited amount of data, exhausting the system's memory and causing the entire application to crash.

Technologies: [Nine Nines Gun](https://junglewise.ai/threats/technologies/gun). Vendors: [Nine Nines](https://junglewise.ai/threats/vendors/nine-nines).

## Quick answers

**Is CVE-2026-43974 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-43974 being exploited in the wild.

**How severe is CVE-2026-43974?** High severity, with a CVSS score of 8.7, published 8 June 2026.

**Which products and versions are affected?** Nine Nines Gun >= 2.0.0, < 2.4.0.

**Is there a fix for CVE-2026-43974?** A patch was published on 2026-05-29: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-43974 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-43974?** Check whether you run Nine Nines Gun at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability in the `gun_http:handle_inform/8` function of the Gun HTTP client fails to verify if an 'Upgrade' request was actually initiated by the client before processing a '101 Switching Protocols' response. When a malicious server sends an unsolicited 101 response over HTTP/1.1, Gun transitions the connection to raw protocol mode (`gun_raw`). In this state, flow control is disabled (`flow=infinity`) and the socket active mode is re-armed after every packet. An attacker can exploit this to flood the client with arbitrary bytes, exhausting the Erlang VM's (BEAM) mailbox and memory, resulting in a crash. The issue is fixed in version 2.4.0 by ensuring 101 responses are rejected with a protocol error if no upgrade was requested.

## Affected products

- ninenines gun >= 2.0.0, < 2.4.0

## Identifiers

- CVE-2026-43974
- GHSA-2j82-37xg-f9wp

## Timeline

- 2026-05-29: patched: Fix committed to repository
- 2026-06-08: disclosed: CVE-2026-43974 published
- 2026-07-29: advisory: GitHub Advisory reviewed and updated

## References

- [https://github.com/ninenines/gun/commit/5b48068c29ce5e112cb149b5857c7d4dc319a81b](https://github.com/ninenines/gun/commit/5b48068c29ce5e112cb149b5857c7d4dc319a81b)
- [https://cna.erlef.org/cves/CVE-2026-43974.html](https://cna.erlef.org/cves/CVE-2026-43974.html)

## Related threats

- [ninenines gun uncontrolled resource consumption in gun_http](https://junglewise.ai/threats/cve-2026-43973-ninenines-gun-uncontrolled-resource-consumption-in-gun-http)
- [ninenines gun cross-origin cookie injection in gun_http2](https://junglewise.ai/threats/cve-2026-43972-ninenines-gun-cross-origin-cookie-injection-in-gun-http2)