gun (Hex)

Advisories

Latest version

—

License

—

OpenSSF Scorecard

—

How to fix

Upgrading to 2.16.0 or later clears every advisory below that has a fix.

Upgrade commands

mix

{:gun, "~> 2.16.0"} # then: mix deps.update gun

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
EEF-CVE-2026-43966 HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2	Medium EPSS 0.26%	`< 2.16.0`	`2.16.0`
EEF-CVE-2026-43973 gun HTTP/1.1 response buffer has no size limit allowing server-controlled memory exhaustion	High EPSS 0.48%	`>= 1.0.0, < 2.4.0`	`2.4.0`
EEF-CVE-2026-43973 gun HTTP/1.1 response buffer has no size limit allowing server-controlled memory exhaustion	High EPSS 0.48%	`>= 1.0.0, < 2.4.0`	`2.4.0`
EEF-CVE-2026-43972 gun HTTP/2 PUSH_PROMISE authority not validated against connection origin allows cross-origin cookie injection	High EPSS 0.17%	`>= 2.0.0, < 2.4.0`	`2.4.0`
EEF-CVE-2026-43972 gun HTTP/2 PUSH_PROMISE authority not validated against connection origin allows cross-origin cookie injection	High EPSS 0.17%	`>= 2.0.0, < 2.4.0`	`2.4.0`
EEF-CVE-2026-43974 gun HTTP/1.1 client accepts unsolicited 101 Switching Protocols response allowing server-driven protocol hijack and OOM	High EPSS 0.48%	`>= 2.0.0, < 2.4.0`	`2.4.0`
EEF-CVE-2026-43974 gun HTTP/1.1 client accepts unsolicited 101 Switching Protocols response allowing server-driven protocol hijack and OOM	High EPSS 0.48%	`>= 2.0.0, < 2.4.0`	`2.4.0`

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor