Vulnerability EEF-CVE-2026-43972
Advisory details are being prepared in the background.
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
5 months ago
June 08, 2026 at 02:12 PM UTC
gun HTTP/2 PUSH_PROMISE authority not validated against connection origin allows cross-origin cookie injection
2.0.0 - 2.3.0
2.0.0 - 2.3.0
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
5 months ago
cowboy and gun affected by an HTTP Request/Response Splitting vulnerability
1.0.0-pre.1 - 2.7.0 GHSA-w4f7-4cxr-rv3c
1.0.0-pre.1 - 2.7.0 GHSA-w4f7-4cxr-rv3c
High Risk
5 months ago
gun has an Unexpected Status Code or Return Value vulnerability
2.0.0 - 2.3.0 GHSA-2j82-37xg-f9wp
2.0.0 - 2.3.0 GHSA-2j82-37xg-f9wp
High Risk
5 months ago
gun has an Uncontrolled Resource Consumption vulnerability
1.0.0 - 2.3.0 GHSA-r53j-fjj5-mv77
1.0.0 - 2.3.0 GHSA-r53j-fjj5-mv77
Medium Risk
5 months ago
gun_http2 has an Origin Validation Error vulnerability
2.0.0 - 2.3.0 GHSA-36w4-95hv-5vwg
2.0.0 - 2.3.0 GHSA-36w4-95hv-5vwg
Unknown
5 months ago
gun HTTP/1.1 response buffer has no size limit allowing server-controlled memory exhaustion
1.0.0 - 2.3.0 EEF-CVE-2026-43973
1.0.0 - 2.3.0 EEF-CVE-2026-43973
Impacted packages
Timeline
Published
5 months ago
June 08, 2026 at 02:12 PM UTC
Fixed (2.4.0)
5 months ago
June 08, 2026 at 01:17 PM UTC
Last Modified
1 month ago
September 08, 2026 at 03:30 AM UTC