EEF-CVE-2026-43972 CVE-2026-43972 GHSA-36w4-95hv-5vwg
gun HTTP/2 PUSH_PROMISE authority not validated against connection origin allows cross-origin cookie injection
- Severity
- 0.0 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 0.17%
- Chance of exploitation in the next 30 days. Higher than 6.08% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-346 Origin Validation Error
- Fix
2.4.0- Upgrade gun to this version or later
Description
Summary
Origin Validation Error vulnerability in ninenines gun (gun_http2 module) allows cross-origin cookie injection via unvalidated HTTP/2 PUSH_PROMISE authority.
In gun_http2:push_promise_frame/7, the :authority pseudo-header from an incoming PUSH_PROMISE frame is stored verbatim into the promised stream record without checking that it matches the connection's origin. When gun_http2:headers_frame/9 later processes the response headers for the promised stream, it calls gun_cookies:set_cookie_header/7 with the unvalidated server-supplied authority before any status branching and before user code can act. This violates RFC 7540 §10.6 / RFC 9113 §8.4, which require receivers to treat as a protocol error any push for a resource the server is not authoritative for.
A malicious or compromised HTTP/2 server can plant cookies scoped to arbitrary third-party domains into the client's shared cookie store. This enables session fixation attacks against those domains and, if the planted cookie overrides a legitimate session token, may result in account takeover. No user interaction beyond making a normal HTTP/2 request to the attacker-controlled server is required.
This issue affects gun: from 2.0.0 before 2.4.0.
Configurations
The vulnerability is exploitable only when gun is configured with a cookie_store and connects to an HTTP/2 server with server push enabled.
Affected versions
Hex
| Package | Vulnerable | Fixed in |
|---|---|---|
| gun | >= 2.0.0, < 2.4.0 |
2.4.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
gun Hex → 2.4.0
- mix
{:gun, "~> 2.4.0"} # then: mix deps.update gun
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- Low
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- Low
- Integrity (subsequent systems)
- Low
- Availability (subsequent systems)
- None
CVSS 3.1 7.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Changed
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Weakness
CWE-346: Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
References
Advisories
Fixes and patches
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| EEF-CVE-2026-43966 HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2 | Medium | Also affects gun |
| EEF-CVE-2026-43973 gun HTTP/1.1 response buffer has no size limit allowing server-controlled memory exhaustion | High | Also affects gun |
| EEF-CVE-2026-43974 gun HTTP/1.1 client accepts unsolicited 101 Switching Protocols response allowing server-driven protocol hijack and OOM | High | Also affects gun |
| GHSA-997q-gvvc-jwmx Electron: openExternal permission requests can be attributed to the wrong origin | Medium | Same weakness, CWE-346 |
| GHSA-fw47-9c62-h3vw Electron: HID and USB permission checks can be attributed to the wrong origin | Medium | Same weakness, CWE-346 |
| GHSA-x562-297c-g43g Electron: Pointer lock permission requests can be attributed to the wrong frame | Medium | Same weakness, CWE-346 |
| GHSA-xcx6-jx8p-x3h5 MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint | Medium | Same weakness, CWE-346 |
| GHSA-4w7w-5xrc-9h26 undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects | Critical | Same weakness, CWE-346 |
Credits: Loïc Hoguin, Peter Ullrich
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor