CVE-2026-43974

Name of the Vulnerable Software and Affected Versions gun versions 2.0.0 through 2.3.x

Description An issue in the gun http module allows a malicious HTTP server to force a client into raw protocol mode by sending an unsolicited 101 Switching Protocols response. In the handle inform/8 function, the software verifies the syntax of the Upgrade header and the stream reference but fails to check if the client actually requested an upgrade via Upgrade or Connection: upgrade headers. Consequently, any 101 response triggers a gun upgrade message and transitions the connection to raw protocol mode. In this mode, gun raw disables flow control and re-arms socket active mode after every packet, enabling a server to flood the client with arbitrary bytes. These are forwarded as unbounded gun data messages, which can exhaust the owner process mailbox and BEAM memory, leading to a virtual machine crash.

Recommendations Update to version 2.4.0 or later.