Vulnerability in Ninenines Gun

CVE-2026-43974

Unexpected Status Code or Return Value vulnerability in ninenines gun (gun_http module) allows a malicious HTTP server to force the client into raw protocol mode via an unsolicited 101 Switching Protocols response. In gun_http:handle_info…

EPSS: 0.004 (30.6th percentile) — read the EPSS interpretation.

Affected products

Ninenines Gun — versions 2.0.0, a3c2edbb8c807717e2f10520c6cf1e77a62eab2e

Weakness classification (CWE)

CWE-841 — Improper Enforcement of Behavioral Workflow

References

6b3ad84c-e1a6-4bf7-a703-f496b71e49db (related, third-party-advisory)
6b3ad84c-e1a6-4bf7-a703-f496b71e49db (patch)
6b3ad84c-e1a6-4bf7-a703-f496b71e49db (related)