FKIE_CVE-2026-43973
Vulnerability from fkie_nvd - Published: 2026-06-08 15:16 - Updated: 2026-07-23 07:10
Severity
Summary
Uncontrolled Resource Consumption vulnerability in ninenines gun (gun_http module) allows a malicious server to exhaust client memory via unbounded HTTP/1.1 response buffering.
In gun_http:handle/5, three clauses accumulate incoming TCP data into the connection's buffer field using binary concatenation with no upper-bound check: the head clause appends data until the \r\n\r\n header terminator is found; the body_chunked clause appends data whenever cow_http_te:stream_chunked/2 returns a more result indicating an incomplete chunk boundary; and the body_trailer clause appends data until the trailing \r\n\r\n is found. In each case, when the expected terminator never arrives, the enlarged binary is stored back into state and the process waits for more data, with no configurable or hard-coded ceiling on buffer size.
A malicious or compromised server can exploit this by sending a partial response that never completes. For example, a response may begin with HTTP/1.1 200 OK\r\nX-Pad: followed by an unbounded stream of arbitrary bytes, never sending the header terminator. The gun connection process will continuously append the incoming data to its buffer, causing unbounded heap growth. Because BEAM imposes no per-process heap limit by default, a single malicious connection can exhaust all available memory on the node, causing a node-wide out-of-memory crash.
This issue affects gun: from 1.0.0 before 2.4.0.
References
Impacted products
| Vendor | Product | Version |
|---|
{
"affected": [
{
"affectedData": [
{
"cpes": [
"cpe:2.3:a:ninenines:gun:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"gun_http"
],
"packageName": "gun",
"packageURL": "pkg:hex/gun",
"product": "gun",
"programFiles": [
"src/gun_http.erl"
],
"programRoutines": [
{
"name": "gun_http:handle/5"
}
],
"repo": "https://github.com/ninenines/gun",
"vendor": "ninenines",
"versions": [
{
"lessThan": "2.4.0",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ninenines:gun:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"gun_http"
],
"packageName": "ninenines/gun",
"packageURL": "pkg:github/ninenines/gun",
"product": "gun",
"programFiles": [
"src/gun_http.erl"
],
"programRoutines": [
{
"name": "gun_http:handle/5"
}
],
"repo": "https://github.com/ninenines/gun.git",
"vendor": "ninenines",
"versions": [
{
"lessThan": "f3e7e0568b3c4cf9fa4bea79d5116e67ce76ad25",
"status": "affected",
"version": "11dfe71f4b9aedaaedea2ad3b2f32fd006a8480f",
"versionType": "git"
}
]
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Uncontrolled Resource Consumption vulnerability in ninenines gun (gun_http module) allows a malicious server to exhaust client memory via unbounded HTTP/1.1 response buffering.\n\nIn gun_http:handle/5, three clauses accumulate incoming TCP data into the connection\u0027s buffer field using binary concatenation with no upper-bound check: the head clause appends data until the \\r\\n\\r\\n header terminator is found; the body_chunked clause appends data whenever cow_http_te:stream_chunked/2 returns a more result indicating an incomplete chunk boundary; and the body_trailer clause appends data until the trailing \\r\\n\\r\\n is found. In each case, when the expected terminator never arrives, the enlarged binary is stored back into state and the process waits for more data, with no configurable or hard-coded ceiling on buffer size.\n\nA malicious or compromised server can exploit this by sending a partial response that never completes. For example, a response may begin with HTTP/1.1 200 OK\\r\\nX-Pad: followed by an unbounded stream of arbitrary bytes, never sending the header terminator. The gun connection process will continuously append the incoming data to its buffer, causing unbounded heap growth. Because BEAM imposes no per-process heap limit by default, a single malicious connection can exhaust all available memory on the node, causing a node-wide out-of-memory crash.\n\nThis issue affects gun: from 1.0.0 before 2.4.0."
},
{
"lang": "es",
"value": "Vulnerabilidad de Consumo de Recursos Incontrolado en ninenines gun (m\u00f3dulo gun_http) permite a un servidor malicioso agotar la memoria del cliente a trav\u00e9s del almacenamiento en b\u00fafer de respuestas HTTP/1.1 ilimitado.\n\nEn gun_http:handle/5, tres cl\u00e1usulas acumulan datos TCP entrantes en el campo de b\u00fafer de la conexi\u00f3n utilizando concatenaci\u00f3n binaria sin verificaci\u00f3n de l\u00edmite superior: la cl\u00e1usula \u0027head\u0027 a\u00f1ade datos hasta que se encuentra el terminador de encabezado \\r\\n\\r\\n; la cl\u00e1usula \u0027body_chunked\u0027 a\u00f1ade datos cada vez que cow_http_te:stream_chunked/2 devuelve un resultado \u0027more\u0027 indicando un l\u00edmite de fragmento incompleto; y la cl\u00e1usula \u0027body_trailer\u0027 a\u00f1ade datos hasta que se encuentra el \\r\\n\\r\\n final. En cada caso, cuando el terminador esperado nunca llega, el binario ampliado se almacena de nuevo en el estado y el proceso espera m\u00e1s datos, sin un l\u00edmite configurable o codificado r\u00edgidamente para el tama\u00f1o del b\u00fafer.\n\nUn servidor malicioso o comprometido puede explotar esto enviando una respuesta parcial que nunca se completa. Por ejemplo, una respuesta puede comenzar con HTTP/1.1 200 OK\\r\\nX-Pad: seguido de un flujo ilimitado de bytes arbitrarios, sin enviar nunca el terminador de encabezado. El proceso de conexi\u00f3n de gun a\u00f1adir\u00e1 continuamente los datos entrantes a su b\u00fafer, causando un crecimiento ilimitado del \u0027heap\u0027. Debido a que BEAM no impone un l\u00edmite de \u0027heap\u0027 por proceso por defecto, una \u00fanica conexi\u00f3n maliciosa puede agotar toda la memoria disponible en el nodo, causando un fallo por falta de memoria en todo el nodo.\n\nEste problema afecta a gun: desde 1.0.0 antes de 2.4.0."
}
],
"id": "CVE-2026-43973",
"lastModified": "2026-07-23T07:10:00.113",
"metrics": {
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-43973",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-08T15:48:05.292583Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-06-08T15:16:46.700",
"references": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://cna.erlef.org/cves/CVE-2026-43973.html"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/ninenines/gun/commit/f3e7e0568b3c4cf9fa4bea79d5116e67ce76ad25"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-43973"
}
],
"sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-770"
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
Loading…
Loading…