Skip to content
OpenAdvisories

Product · ninenines

gun

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.3
    CVE-2026-43972

    gun HTTP/2 PUSH_PROMISE authority not validated against connection origin allows cross-origin cookie injection

    Origin Validation Error vulnerability in ninenines gun (gun_http2 module) allows cross-origin cookie injection via unvalidated HTTP/2 PUSH_PROMISE authority. In gun_http2:push_promise_frame/7, the :authority pseudo-header from an incoming PUSH_PROMISE frame i…

    ninenines gun gun Hex