—Hex
EEF-CVE-2026-43972· CVE-2026-43972, GHSA-36w4-95hv-5vwggun HTTP/2 PUSH_PROMISE authority not validated against connection origin allows cross-origin cookie injection
Modified: 9/8/2026
package
Hex/gun
pkg:hex/gun
—Hex
EEF-CVE-2026-43973· CVE-2026-43973, GHSA-r53j-fjj5-mv77gun HTTP/1.1 response buffer has no size limit allowing server-controlled memory exhaustion
Modified: 8/3/2026
—Hex
EEF-CVE-2026-43974· CVE-2026-43974, GHSA-2j82-37xg-f9wpgun HTTP/1.1 client accepts unsolicited 101 Switching Protocols response allowing server-driven protocol hijack and OOM
Modified: 8/3/2026
HIGHHex
GHSA-2j82-37xg-f9wp· CVE-2026-43974, EEF-CVE-2026-43974gun has an Unexpected Status Code or Return Value vulnerability
Modified: 7/29/2026
MEDIUMHex
GHSA-36w4-95hv-5vwg· CVE-2026-43972, EEF-CVE-2026-43972gun_http2 has an Origin Validation Error vulnerability
Modified: 7/29/2026
HIGHHex
GHSA-r53j-fjj5-mv77· CVE-2026-43973, EEF-CVE-2026-43973gun has an Uncontrolled Resource Consumption vulnerability
Modified: 7/29/2026
MEDIUMHex
GHSA-w4f7-4cxr-rv3c· CVE-2026-43966, EEF-CVE-2026-43966cowboy and gun affected by an HTTP Request/Response Splitting vulnerability
Modified: 9/10/2026