Skip to content
OpenAdvisories

Package · Hex

gun

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.3
    CVE-2026-43966

    HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2

    Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in ninenines cowlib allows HTTP response splitting via non-VCHAR bytes in structured-fields string values. cow_http_struct_hd:escape_string/2 in cowlib…

    ninenines cowlib rabbitmq-server cowlib Debian Hex
  • Medium 6.3
    CVE-2026-43972

    gun HTTP/2 PUSH_PROMISE authority not validated against connection origin allows cross-origin cookie injection

    Origin Validation Error vulnerability in ninenines gun (gun_http2 module) allows cross-origin cookie injection via unvalidated HTTP/2 PUSH_PROMISE authority. In gun_http2:push_promise_frame/7, the :authority pseudo-header from an incoming PUSH_PROMISE frame i…

    ninenines gun gun Hex