Unexpected Status Code Vulnerability in NineNines Gun Http Module

CVE-2026-43974

What is CVE-2026-43974?

An unexpected status code vulnerability in the NineNines Gun HTTP module enables attackers to exploit the client's connection by sending an unsolicited 101 Switching Protocols response. This flaw occurs because the gun_http:handle_inform function does not verify whether an Upgrade or Connection: upgrade header was sent by the client in the original request. As a result, any 101 status response—regardless of legitimacy—can lead the Gun client to transition to raw protocol mode. When in this mode, the server can send unbounded amounts of data to the client, overfilling its mailbox and exhausting the BEAM virtual machine's memory, ultimately resulting in a crash. This issue affects Gun versions 2.0.0 up to (but not including) 2.4.0.

References