CVE-2026-43973

A flaw was found in gun. A malicious server can exploit this uncontrolled resource consumption vulnerability by sending a partial HTTP/1.1 response that never completes. This causes the client's memory buffer to grow without bounds, leading to unbounded heap growth and potentially exhausting all...

CVE-2026-43973

creationtimestamp| type| source ---|---|--- 2026-06-08 15:39:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnrzby3lgt2r 2026-06-24 13:20:08+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mozyxzm7v72z...

CVE-2026-43973 gun HTTP/1.1 response buffer has no size limit allowing server-controlled memory exhaustion

Uncontrolled Resource Consumption vulnerability in ninenines gun gunhttp module allows a malicious server to exhaust client memory via unbounded HTTP/1.1 response buffering. In gunhttp:handle/5, three clauses accumulate incoming TCP data into the connection's buffer field using binary concatenati...