Skip to main content
cve.nowby Sazabi
← Hex
HexPackage

gun

4 known vulnerabilities (2 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 2 high, 2 medium
Registry
Hex

Advisories 4

  • CVE-2026-43966Medium 6.3

    HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2

    Affected: fixed in 2.16.0.

  • gun HTTP/1.1 response buffer has no size limit allowing server-controlled memory exhaustion

    Affected: from 1.0.0, fixed in 2.4.0; from 1.0.0, fixed in 2.4.0.

  • CVE-2026-43972Medium 6.3

    gun HTTP/2 PUSH_PROMISE authority not validated against connection origin allows cross-origin cookie injection

    Affected: from 2.0.0, fixed in 2.4.0; from 2.0.0, fixed in 2.4.0.

  • gun HTTP/1.1 client accepts unsolicited 101 Switching Protocols response allowing server-driven protocol hijack and OOM

    Affected: from 2.0.0, fixed in 2.4.0; from 2.0.0, fixed in 2.4.0.