Packages

gun

2.6.0
2.6.0 2.5.0 2.4.1 2.4.0 2.3.0 2.2.0 2.1.0 2.0.1 2.0.0 2.0.0-rc.2 2.0.0-rc.1 1.3.3 1.3.2 1.3.1 1.3.0 1.2.0 1.1.0 1.0.0 1.0.0-pre.4b retired 1.0.0-pre.5 1.0.0-pre.4 1.0.0-pre.2 1.0.0-pre.1

HTTP/1.1, HTTP/2 and Websocket client for Erlang/OTP.

Security advisory: This version has known vulnerabilities. View advisories
HexDocs Report package

Current section

4 Advisories

Jump to
Readme
23 Versions
1 Dependency
95 Dependants
4 Advisories
Files
Activity
GHSA-w4f7-4cxr-rv3c CVE-2026-43966 EEF-CVE-2026-43966

cowboy and gun affected by an HTTP Request/Response Splitting vulnerability

June 08, 2026
CVSS
?
6.3 / 10.0 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

Affected Versions

< 2.16.0
EEF-CVE-2026-43973 CVE-2026-43973 GHSA-r53j-fjj5-mv77

gun HTTP/1.1 response buffer has no size limit allowing server-controlled memory exhaustion

June 08, 2026
CVSS
?
8.7 / 10.0 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected Versions

>= 1.0.0 and < 2.4.0
EEF-CVE-2026-43974 CVE-2026-43974 GHSA-2j82-37xg-f9wp

gun HTTP/1.1 client accepts unsolicited 101 Switching Protocols response allowing server-driven protocol hijack and OOM

June 08, 2026
CVSS
?
8.7 / 10.0 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected Versions

>= 2.0.0 and < 2.4.0
EEF-CVE-2026-43972 CVE-2026-43972 GHSA-36w4-95hv-5vwg

gun HTTP/2 PUSH_PROMISE authority not validated against connection origin allows cross-origin cookie injection

June 08, 2026
CVSS
?
6.3 / 10.0 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Affected Versions

>= 2.0.0 and < 2.4.0

Checksum

Dependency Config

mix.exs

rebar.config

Gleam

erlang.mk

Package Details

Downloads Last 30 days, all versions
0 10K 20K 30K 40K

this version

1 255

yesterday

25 292

last 7 days

117 221

all time

14 706 952

Last Updated

Sep 08, 2026

License

ISC

Build Tools

make rebar3

Publisher

essen essen

Links

Owners