Unexpected Status Code or Return Value vulnerability in ninenines gun (gun_http module) allows a malicious HTTP server to force the client into raw protocol mode via an unsolicited 101 Switching Prot…
High CVSS 7.5
Summary
Unexpected Status Code or Return Value vulnerability in ninenines gun (gun_http module) allows a malicious HTTP server to force the client into raw protocol mode via an unsolicited 101 Switching Protocols response. In gun_http:handle_inform/8, when a 101 Switching Protocols response is received over HTTP/1.1, the function verifies only that the Upgrade header is syntactically valid and that the stream reference is a plain reference(). It does not check whether the client ever sent an Upgrade o…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Sources
- NVD DATABASE
Original Links
- https://cna.erlef.org/cves/CVE-2026-43974.html Third Party Advisory
- https://github.com/ninenines/gun/commit/5b48068c29ce5e112cb149b5857c7d4dc319a81b Patch
- https://osv.dev/vulnerability/EEF-CVE-2026-43974 Third Party Advisory
Timeline
- nvd_ingest NVD