PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-43973 ninenines CVE debrief

CVE-2026-43973 is an Uncontrolled Resource Consumption vulnerability in the gun_http module of the ninenines gun library. The vulnerability allows a malicious server to exhaust client memory via unbounded HTTP/1.1 response buffering. This occurs because the gun_http:handle/5 function accumulates incoming TCP data into the connection's buffer field using binary concatenation with no upper-bound check. A malicious or compromised server can exploit this by sending a partial response that never completes, causing the gun connection process to continuously append incoming data to its buffer, leading to unbounded heap growth and potentially causing a node-wide out-of-memory crash.

Vendor
ninenines
Product
gun
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-08
Original CVE updated
2026-08-18
Advisory published
2026-06-08
Advisory updated
2026-08-18

Who should care

Users of the ninenines gun library, particularly those using versions from 1.0.0 before 2.4.0, should be aware of this vulnerability and take steps to mitigate it.

Technical summary

The vulnerability is caused by the lack of an upper-bound check in the gun_http:handle/5 function when accumulating incoming TCP data into the connection's buffer field. This allows a malicious server to send a partial response that never completes, causing the gun connection process to continuously append incoming data to its buffer, leading to unbounded heap growth.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade to gun version 2.4.0 or later.
  • Implement a configurable or hard-coded ceiling on buffer size to prevent unbounded heap growth.

Evidence notes

The CVE-2026-43973 vulnerability was reported by an unknown vendor and has a CVSS score of 8.7, indicating a HIGH severity.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-43973 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-43973

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-43973 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-43973

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://cna.erlef.org/cves/CVE-2026-43973.html

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

  • Source reference

    Unverified legacy reference

    URL: https://github.com/ninenines/gun/commit/f3e7e0568b3c4cf9fa4bea79d5116e67ce76ad25

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

  • Source reference

    Unverified legacy reference

    URL: https://osv.dev/vulnerability/EEF-CVE-2026-43973

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.