ninenines gun HTTP Client Unrequested 101 Response Protocol Hijacking and OOM (CVE-2026-43974)

Vulnerability Overview CVE ID: CVE-2026-43974 Vulnerability Name: gun HTTP/1.1 client accepts unsolicited 101 Switching Protocols responses, enabling server-driven protocol hijacking and OOM CVSS 4.0 Score: 8.7 (High) Weakness Type (CWE): CWE-841 — CWE-841 Improper Enforcement of Behavioral Workflow CAPEC: CAPEC-220 — CAPEC-220 Client-Server Protocol Manipulation, CAPEC-130 — CAPEC-130 Excessive Allocation Vulnerability Description Vulnerability Type: Unexpected Status Code or Return Value vulnerability Affected Module: nininines gun ( module) Vulnerability Mechanism: When receiving an unsolicited 101 Switching Protocols response, the function only validates that the Upgrade header is syntactically correct and that the stream reference is a plain reference. It fails to check whether the client originally sent Upgrade or Connection headers. This causes to send a message to the caller and convert the entire connection to protocol mode. Attack Consequences: A malicious or compromised HTTP server can send an unsolicited 101 response, causing the client to cease HTTP frame processing. Once in raw mode, the application operates without flow control ( ) and re-enables mode. The server can then send arbitrary bytes to the client, which are forwarded as unbounded messages to the owning process. This exhausts the mailbox and BEAM memory, ultimately causing the VM to crash. Affected Versions Affected Versions: gun 2.0.0 to 2.4.0 Affected Module: - Module: - Source File: - Routine: - Status: Affected - Type: server - Version: 2.0.0 - Changes / Fixed In: < 2.4.0 Remediation Fixed Version: 2.4.0 Fix Commit: GitHub Commit References OSV Vulnerability GitHub Commit Contributors Finder: Peter Ulrich Remediation Developer: Loic Hoguin

Goal Reached Thanks to every supporter — we hit 100%!

ninenines gun HTTP Client Unrequested 101 Response Protocol Hijacking and OOM (CVE-2026-43974)