CVE-2026-43973

Name of the Vulnerable Software and Affected Versions ninenines gun versions 1.0.0 through 2.3.x

Description Uncontrolled Resource Consumption in the gun http module allows a malicious server to exhaust client memory through unbounded HTTP/1.1 response buffering. In the handle()/5 function, three clauses accumulate incoming TCP data into the connection's buffer using binary concatenation without an upper-bound check. Specifically, the head clause appends data until the header terminator is found, the body chunked clause appends data when cow http te:stream chunked()/2 indicates an incomplete chunk boundary, and the body trailer clause appends data until the trailing terminator is found. If the expected terminator never arrives, the binary grows indefinitely in the state. A malicious server can exploit this by sending a partial response that never completes, leading to unbounded heap growth. Since BEAM does not impose per-process heap limits by default, a single connection can exhaust all available memory on the node, resulting in a node-wide out-of-memory crash.

Recommendations Update to version 2.4.0 or later.