PatchSiren cyber security CVE debrief

CVE-2026-43972 ninenines CVE debrief

CVE-2026-43972 is an Origin Validation Error vulnerability in the gun_http2 module of ninenines gun. The vulnerability allows cross-origin cookie injection via unvalidated HTTP/2 PUSH_PROMISE authority. This occurs because the :authority pseudo-header from an incoming PUSH_PROMISE frame is stored verbatim into the promised stream record without checking that it matches the connection's origin. As a result, a malicious or compromised HTTP/2 server can plant cookies scoped to arbitrary third-party domains into the client's shared cookie store, enabling session fixation attacks against those domains and potentially resulting in account takeover.

Vendor: ninenines
Product: gun
CVSS: MEDIUM 6.3
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-06-08
Original CVE updated: 2026-08-18
Advisory published: 2026-06-08
Advisory updated: 2026-08-18

Who should care

Users of ninenines gun (gun_http2 module) from version 2.0.0 before 2.4.0 should be aware of this vulnerability.

Technical summary

The vulnerability is caused by the lack of validation of the :authority pseudo-header in the gun_http2:push_promise_frame/7 function. This allows an attacker to inject cookies into the client's shared cookie store, potentially leading to session fixation attacks and account takeover.

Defensive priority

MEDIUM

Recommended defensive actions

Update to version 2.4.0 or later of ninenines gun (gun_http2 module) to fix the vulnerability.
Implement proper validation of the :authority pseudo-header in the gun_http2:push_promise_frame/7 function.

Evidence notes

The CVE-2026-43972 vulnerability was published on 2026-06-08T15:16:46.290Z and modified on 2026-06-09T15:20:13.097Z.

Sources and references

Verified primary and authoritative sources

CVE-2026-43972 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-43972

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-43972 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-43972

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://cna.erlef.org/cves/CVE-2026-43972.html

6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Source reference
Unverified legacy reference

URL: https://github.com/ninenines/gun/commit/567863ff53802fed21c3b3f25812db7f7ae29676

6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Source reference
Unverified legacy reference

URL: https://osv.dev/vulnerability/EEF-CVE-2026-43972

6b3ad84c-e1a6-4bf7-a703-f496b71e49db

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.