CVE-2026-43974: Ninenines Gun HTTP Client DOS Vulnerability

CVE-2026-43974 Overview

CVE-2026-43974 is an unexpected status code vulnerability in the ninenines/gun Erlang HTTP client library, specifically in the gun_http module. The flaw allows a malicious or compromised HTTP server to force the client into raw protocol mode by sending an unsolicited 101 Switching Protocols response. Once the client transitions to raw mode, the server can flood it with unbounded data, exhausting BEAM virtual machine memory and crashing the host process. The issue affects gun versions 2.0.0 through versions prior to 2.4.0 and is tracked under CWE-841: Improper Enforcement of Behavioral Workflow.

Critical Impact
A single malicious HTTP response can crash the entire Erlang VM, producing a denial-of-service condition against any service that uses gun as an HTTP client.

Affected Products

ninenines gun 2.0.0
ninenines gun 2.x releases prior to 2.4.0
Erlang/OTP applications and services embedding vulnerable gun versions as an HTTP client

Discovery Timeline

2026-06-08 - CVE-2026-43974 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-43974

Vulnerability Analysis

The vulnerability resides in gun_http:handle_inform/8. When a 101 Switching Protocols response arrives over HTTP/1.1, the function validates only the syntax of the Upgrade header and confirms the stream reference is a plain reference(). It does not verify whether the client originally sent an Upgrade or Connection: upgrade header on the matching request. As a result, any 101 response, solicited or not, triggers a gun_upgrade message to the caller and switches the connection to raw protocol mode handled by gun_raw.

In raw mode, gun sets flow control to infinity and re-arms socket active mode after every received packet. The server can then push arbitrary bytes that the client forwards as unbounded gun_data messages to the owner process. The owner mailbox grows without limit, exhausting BEAM memory and crashing the VM.

Root Cause

The root cause is missing state validation in the HTTP upgrade workflow [CWE-841]. The client treats a server-initiated protocol switch as legitimate without correlating it to a client-issued upgrade request. This violates RFC 7230 expectations and removes the only check that would prevent an attacker-controlled server from unilaterally changing protocol semantics on a live connection.

Attack Vector

An attacker controlling or impersonating an HTTP server returns a 101 Switching Protocols response to a routine HTTP/1.1 request issued by a gun client. The client accepts the switch, disables HTTP framing, and enters raw mode. The attacker then streams unbounded data, saturating the owner process mailbox until the BEAM VM exhausts memory and terminates. The attack requires no authentication, no user interaction, and only network reachability to a server the client connects to. Vulnerable scenarios include outbound integrations, webhook delivery, microservice clients, and any code path where gun fetches data from untrusted or upstream-compromised endpoints.

No public proof-of-concept exploit is currently listed. See the CNA Security Advisory for additional technical details.

Detection Methods for CVE-2026-43974

Indicators of Compromise

Unexpected gun_upgrade messages received by processes that never issued an HTTP upgrade request
Rapid growth of an Erlang process mailbox holding gun_data tuples from a single connection
BEAM VM crashes preceded by memory pressure and high message-queue length on gun owner processes
Outbound HTTP/1.1 connections receiving 101 Switching Protocols responses without a prior Upgrade header in the request

Detection Strategies

Inspect HTTP traffic at egress for 101 responses that do not correspond to a client Upgrade: websocket or similar request header
Instrument gun callers to log or assert that gun_upgrade messages only arrive on streams that explicitly requested an upgrade
Track Erlang process memory and message_queue_len for gun owner processes and alert on abnormal growth

Monitoring Recommendations

Forward BEAM crash dumps and erlang:system_monitor events to a centralized logging platform for correlation
Monitor outbound HTTP connection metadata, including response status code distribution per upstream host
Alert on repeated VM restarts of services that embed gun as an HTTP dependency

How to Mitigate CVE-2026-43974

Immediate Actions Required

Upgrade ninenines/gun to version 2.4.0 or later in all Erlang/Elixir projects
Audit rebar.config, mix.exs, and lock files for transitive dependencies on gun versions 2.0.0 through 2.3.x
Restart long-running services after upgrading to ensure no vulnerable code paths remain loaded in the BEAM
Restrict outbound HTTP destinations to trusted hosts where feasible, reducing exposure to malicious upstream servers

Patch Information

The maintainers fixed the issue by enforcing that a 101 Switching Protocols response is only accepted when the client actually issued a matching upgrade request. The fix is available in gun 2.4.0. Review the upstream patch in the GitHub Commit Update and the OSV Vulnerability Report for full advisory details.

Workarounds

Where upgrading is not immediately possible, route gun traffic only through trusted reverse proxies that strip unsolicited 101 responses
Wrap gun owner processes with supervisors that enforce strict mailbox limits and terminate on abnormal gun_data volume
Disable or avoid HTTP/1.1 endpoints that are not under organizational control until the library is patched

bash

# Example dependency pin in rebar.config
{deps, [
    {gun, "2.4.0"}
]}.

# Example dependency pin in mix.exs
# {:gun, "~> 2.4.0"}