Executive Summary

CVE-2026-43973 is an uncontrolled resource consumption vulnerability in the ninenines gun HTTP/1.1 client library, specifically in the gun_http module. The vulnerability arises because the function gun_http:handle/5 accumulates incoming TCP data into a buffer without any upper-bound checks in three scenarios: parsing headers until the header terminator \r\n\r\n is found, handling chunked transfer encoding until an incomplete chunk boundary is resolved, and processing trailers until the trailer terminator \r\n\r\n is found.

If a malicious or compromised server sends a partial HTTP response that never completes (for example, starting a response but never sending the header terminator), the buffer will grow indefinitely as data is continuously appended. Because the BEAM virtual machine does not impose per-process heap limits by default, this unbounded buffer growth can exhaust all available memory on the client node, causing a node-wide out-of-memory crash.

This issue affects gun versions from 1.0.0 before 2.4.0.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a denial-of-service (DoS) condition on the client side by exhausting all available memory. A malicious server can exploit the vulnerability by sending an incomplete HTTP response that causes the client's buffer to grow without limit, eventually causing the entire node running the gun client to crash due to out-of-memory.

Such a crash can disrupt services relying on the gun HTTP client, leading to downtime, loss of availability, and potential cascading failures in systems depending on the affected node.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unusually high memory usage by the gun HTTP client process, which may indicate unbounded buffer growth caused by a malicious or compromised server sending incomplete HTTP/1.1 responses.

Since the vulnerability involves unbounded buffering of HTTP response data, you can look for gun client processes consuming excessive memory or hanging connections waiting for response terminators.

Specific commands to detect this condition might include:

• Using system tools like `top` or `htop` to identify processes with high memory usage.
• Using `lsof` or `netstat` to identify open TCP connections to suspicious or untrusted servers.
• Using Erlang observer or process inspection tools to monitor the memory usage of gun connection processes.
• Checking logs or metrics for repeated or long-lived HTTP connections without complete responses.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade the gun HTTP client library to version 2.4.0 or later, where the issue is fixed.

The fix introduces configurable options `max_header_block_size` and `max_trailer_block_size` that impose soft limits on the maximum size of response header and trailer blocks, preventing unbounded buffer growth.

By setting these options, the gun client will close connections that exceed these limits with a `limit_reached` error, protecting against memory exhaustion attacks.

Until you can upgrade, consider monitoring and limiting memory usage of gun processes and restricting connections to trusted servers only.

Useful 0 Not Useful 0