« Volver al listado

CVE-2026-43973

Estado: AnalizadaAlta (8.7)—

Uncontrolled Resource Consumption vulnerability in ninenines gun (gun_http module) allows a malicious server to exhaust client memory via unbounded HTTP/1.1 response buffering.

In gun_http:handle/5, three clauses accumulate incoming TCP data into the connection's buffer field using binary concatenation with no upper-bound check: the head clause appends data until the \r\n\r\n header terminator is found; the body_chunked clause appends data whenever cow_http_te:stream_chunked/2 returns a more result indicating an incomplete chunk boundary; and the body_trailer clause appends data until the trailing \r\n\r\n is found.

Leer descripción completaMostrar menos

In each case, when the expected terminator never arrives, the enlarged binary is stored back into state and the process waits for more data, with no configurable or hard-coded ceiling on buffer size.

A malicious or compromised server can exploit this by sending a partial response that never completes. For example, a response may begin with HTTP/1.1 200 OK\r\nX-Pad: followed by an unbounded stream of arbitrary bytes, never sending the header terminator. The gun connection process will continuously append the incoming data to its buffer, causing unbounded heap growth. Because BEAM imposes no per-process heap limit by default, a single malicious connection can exhaust all available memory on the node, causing a node-wide out-of-memory crash.

This issue affects gun: from 1.0.0 before 2.4.0.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad en cliente HTTP (gun) explotable remotamente sin autenticación (AV:N/PR:N/UI:N). Un servidor malicioso causa DoS por consumo de memoria no acotado.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (1)

Ninenines — GUN

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-43973",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-43973",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-08T15:48:05.292583Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 8.7,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:ninenines:gun:*:*:*:*:*:*:*:*"
          ],
          "repo": "https://github.com/ninenines/gun",
          "vendor": "ninenines",
          "modules": [
            "gun_http"
          ],
          "product": "gun",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0",
              "lessThan": "2.4.0",
              "versionType": "semver"
            }
          ],
          "packageURL": "pkg:hex/gun",
          "packageName": "gun",
          "programFiles": [
            "src/gun_http.erl"
          ],
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "gun_http:handle/5"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:ninenines:gun:*:*:*:*:*:*:*:*"
          ],
          "repo": "https://github.com/ninenines/gun.git",
          "vendor": "ninenines",
          "modules": [
            "gun_http"
          ],
          "product": "gun",
          "versions": [
            {
              "status": "affected",
              "version": "11dfe71f4b9aedaaedea2ad3b2f32fd006a8480f",
              "lessThan": "f3e7e0568b3c4cf9fa4bea79d5116e67ce76ad25",
              "versionType": "git"
            }
          ],
          "packageURL": "pkg:github/ninenines/gun",
          "packageName": "ninenines/gun",
          "programFiles": [
            "src/gun_http.erl"
          ],
          "collectionURL": "https://github.com",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "gun_http:handle/5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-06-08T15:16:46.700",
  "references": [
    {
      "url": "https://cna.erlef.org/cves/CVE-2026-43973.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/ninenines/gun/commit/f3e7e0568b3c4cf9fa4bea79d5116e67ce76ad25",
      "tags": [
        "Patch"
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-43973",
      "tags": [
        "Third Party Advisory",
        "Patch"
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Uncontrolled Resource Consumption vulnerability in ninenines gun (gun_http module) allows a malicious server to exhaust client memory via unbounded HTTP/1.1 response buffering.\n\nIn gun_http:handle/5, three clauses accumulate incoming TCP data into the connection's buffer field using binary concatenation with no upper-bound check: the head clause appends data until the \\r\\n\\r\\n header terminator is found; the body_chunked clause appends data whenever cow_http_te:stream_chunked/2 returns a more result indicating an incomplete chunk boundary; and the body_trailer clause appends data until the trailing \\r\\n\\r\\n is found. In each case, when the expected terminator never arrives, the enlarged binary is stored back into state and the process waits for more data, with no configurable or hard-coded ceiling on buffer size.\n\nA malicious or compromised server can exploit this by sending a partial response that never completes. For example, a response may begin with HTTP/1.1 200 OK\\r\\nX-Pad:  followed by an unbounded stream of arbitrary bytes, never sending the header terminator. The gun connection process will continuously append the incoming data to its buffer, causing unbounded heap growth. Because BEAM imposes no per-process heap limit by default, a single malicious connection can exhaust all available memory on the node, causing a node-wide out-of-memory crash.\n\nThis issue affects gun: from 1.0.0 before 2.4.0."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de Consumo de Recursos Incontrolado en ninenines gun (módulo gun_http) permite a un servidor malicioso agotar la memoria del cliente a través del almacenamiento en búfer de respuestas HTTP/1.1 ilimitado.\n\nEn gun_http:handle/5, tres cláusulas acumulan datos TCP entrantes en el campo de búfer de la conexión utilizando concatenación binaria sin verificación de límite superior: la cláusula 'head' añade datos hasta que se encuentra el terminador de encabezado \\r\\n\\r\\n; la cláusula 'body_chunked' añade datos cada vez que cow_http_te:stream_chunked/2 devuelve un resultado 'more' indicando un límite de fragmento incompleto; y la cláusula 'body_trailer' añade datos hasta que se encuentra el \\r\\n\\r\\n final. En cada caso, cuando el terminador esperado nunca llega, el binario ampliado se almacena de nuevo en el estado y el proceso espera más datos, sin un límite configurable o codificado rígidamente para el tamaño del búfer.\n\nUn servidor malicioso o comprometido puede explotar esto enviando una respuesta parcial que nunca se completa. Por ejemplo, una respuesta puede comenzar con HTTP/1.1 200 OK\\r\\nX-Pad: seguido de un flujo ilimitado de bytes arbitrarios, sin enviar nunca el terminador de encabezado. El proceso de conexión de gun añadirá continuamente los datos entrantes a su búfer, causando un crecimiento ilimitado del 'heap'. Debido a que BEAM no impone un límite de 'heap' por proceso por defecto, una única conexión maliciosa puede agotar toda la memoria disponible en el nodo, causando un fallo por falta de memoria en todo el nodo.\n\nEste problema afecta a gun: desde 1.0.0 antes de 2.4.0."
    }
  ],
  "lastModified": "2026-08-18T15:43:43.360",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ninenines:gun:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "04AAA2F4-9E00-4AEF-847F-89DE53ECA680",
              "versionEndExcluding": "2.4.0",
              "versionStartIncluding": "1.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
}