CVE-2026-43972 gun HTTP/2 PUSH_PROMISE authority not validated against connection origin allows cross-origin cookie injection
A malicious HTTP/2 server can inject cookies for arbitrary domains via unvalidated PUSH_PROMISE frames, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43972?
CVE-2026-43972 is a medium-severity vulnerability in ninenines gun, published on 8 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Origin Validation Error vulnerability in ninenines gun (gun_http2 module) allows cross-origin cookie injection via unvalidated HTTP/2 PUSH_PROMISE authority.
In gun_http2:push_promise_frame/7, the :authority pseudo-header from an incoming PUSH_PROMISE frame is stored verbatim into the promised stream record without checking that it matches the connection's origin. When gun_http2:headers_frame/9 later processes the response headers for the promised stream, it calls gun_cookies:set_cookie_header/7 with the unvalidated server-supplied authority before any status branching and before user code can act. This violates RFC 7540 §10.6 / RFC 9113 §8.4, which require receivers to treat as a protocol error any push for a resource the server is not authoritative for.
A malicious or compromised HTTP/2 server can plant cookies scoped to arbitrary third-party domains into the client's shared cookie store. This enables session fixation attacks against those domains and, if the planted cookie overrides a legitimate session token, may result in account takeover. No user interaction beyond making a normal HTTP/2 request to the attacker-controlled server is required.
This issue affects gun: from 2.0.0 before 2.4.0.
Weakness: CWE-346
Which versions are affected by CVE-2026-43972?
3 open source packages ship an affected version, including gun. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
gun Hex | From 2.0.0 | 2.4.0 |
gun Hex | From 2.0.0 | 2.4.0 |
gun Hex | From 2.0.0 | 2.4.0 |
Products include Ninenines Gun.
How do I fix CVE-2026-43972?
Upgrade gun to 2.4.0 or later.
Is CVE-2026-43972 being exploited?
There is no known exploitation of CVE-2026-43972 in the wild and no public exploit code.
Other vulnerabilities in ninenines gun
Sources
Also known as EEF-CVE-2026-43972, GHSA-36w4-95hv-5vwg.