CVE-2026-43972

CVE-2026-43972

Origin Validation Error vulnerability in ninenines gun (gun_http2 module) allows cross-origin cookie injection via unvalidated HTTP/2 PUSH_PROMISE authority. In gun_http2:push_promise_frame/7, the :authority pseudo-header from an incoming…

EPSS: 0.002 (12.0th percentile) — read the EPSS interpretation.

Weakness classification (CWE)

CWE-346 — Origin Validation Error

References

6b3ad84c-e1a6-4bf7-a703-f496b71e49db (related, third-party-advisory)
6b3ad84c-e1a6-4bf7-a703-f496b71e49db (patch)
6b3ad84c-e1a6-4bf7-a703-f496b71e49db (related)