CVE-2026-43973: gun HTTP Client DoS Vulnerability

CVE-2026-43973 Overview

CVE-2026-43973 is an uncontrolled resource consumption vulnerability [CWE-770] in the ninenines/gun Erlang HTTP client library. The flaw resides in the gun_http module, where the handle/5 function accumulates incoming TCP data into the connection buffer without enforcing any upper bound. A malicious or compromised server can send a partial HTTP/1.1 response that never terminates, forcing the client process to grow its heap indefinitely. Because the BEAM virtual machine imposes no per-process heap limit by default, a single malicious connection can exhaust all memory on the Erlang node, triggering a node-wide out-of-memory crash. The issue affects gun versions from 1.0.0 before 2.4.0.

Critical Impact
A single malicious HTTP server can crash an entire Erlang/BEAM node by streaming an unterminated response to a gun client, exhausting all available memory.

Affected Products

ninenines gun versions 1.0.0 through 2.3.x
Erlang/BEAM applications using gun as an HTTP client library
Fixed in gun version 2.4.0

Discovery Timeline

2026-06-08 - CVE-2026-43973 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-43973

Vulnerability Analysis

The vulnerability resides in the gun_http:handle/5 function, which dispatches incoming TCP data based on the parser state. Three clauses contribute to the flaw: the head clause accumulates bytes until the \r\n\r\n header terminator appears; the body_chunked clause appends data whenever cow_http_te:stream_chunked/2 returns a more result indicating an incomplete chunk boundary; and the body_trailer clause buffers data until the trailing \r\n\r\n is observed.

Each clause performs binary concatenation against the existing buffer field in process state. None of the clauses validate the resulting buffer length against a configurable or hard-coded ceiling. When the expected terminator never arrives, the process simply stores the growing binary and waits for more data from the socket.

Root Cause

The root cause is missing input length enforcement during HTTP/1.1 response parsing. The library trusts the remote server to eventually deliver well-formed framing tokens such as the header terminator or a chunk size of zero. Without an upper bound on accumulated buffer size, the parser cannot distinguish between a slow legitimate response and an intentionally unbounded one.

Attack Vector

An attacker controlling an HTTP server contacted by a gun client returns a partial response such as HTTP/1.1 200 OK\r\nX-Pad: followed by an unbounded stream of arbitrary bytes, never sending the header terminator. The gun connection process continuously appends incoming data to its buffer, driving heap growth until the BEAM node exhausts physical memory. The exploitation requires no authentication, no user interaction, and only network reachability from the vulnerable client to the malicious server.

The vulnerability mechanism is documented in the CNA advisory and the corresponding upstream fix commit.

Detection Methods for CVE-2026-43973

Indicators of Compromise

Erlang nodes terminating with out-of-memory errors or erl_crash.dump files referencing gun_http processes with abnormally large heap sizes.
Long-lived outbound TCP connections from gun client processes to untrusted HTTP servers with no completed response.
BEAM process memory growth concentrated in a small number of gun_http connection processes.

Detection Strategies

Monitor BEAM per-process memory usage with erlang:process_info/2 for gun connection processes and alert on processes exceeding expected response size thresholds.
Inspect application dependency manifests (rebar.config, mix.exs) for gun versions below 2.4.0.
Correlate outbound HTTP connections with response completion metrics to identify connections that never finalize header parsing.

Monitoring Recommendations

Enable BEAM crash dump collection and centralized log aggregation to identify recurring OOM terminations.
Track gun client connection lifetimes and flag connections that remain in the head, body_chunked, or body_trailer state for extended durations.
Alert on sudden growth in node memory utilization correlated with traffic to external HTTP endpoints.

How to Mitigate CVE-2026-43973

Immediate Actions Required

Upgrade gun to version 2.4.0 or later across all Erlang and Elixir projects that depend on it.
Audit transitive dependencies because gun is commonly included indirectly through higher-level HTTP client wrappers.
Restrict gun clients to known, trusted HTTP endpoints until the upgrade is deployed.

Patch Information

The fix is delivered in gun2.4.0. See the upstream patch in the ninenines/gun commit f3e7e05. Additional vulnerability metadata is available in the OSV record EEF-CVE-2026-43973.

Workarounds

Apply BEAM per-process heap limits using the max_heap_size spawn option on gun connection processes to bound memory growth.
Enforce response timeouts at the application layer and terminate gun connections that do not complete header parsing within an expected window.
Place an outbound HTTP proxy or egress filter in front of gun clients to restrict communication to vetted destinations.

bash

# Example: pin gun to a fixed version in rebar.config
{deps, [
    {gun, "2.4.0"}
]}.

# Example: enforce a per-process heap ceiling when spawning a gun connection
% In Erlang application code
SpawnOpts = [{max_heap_size, #{size => 4194304, kill => true, error_logger => true}}],
gun:open(Host, Port, #{tcp_opts => [], spawn_opts => SpawnOpts}).