CVE-2026-43972: gun HTTP/2 PUSH_PROMISE authority not validated against connection origin allows cross-origin cookie injection
Origin Validation Error vulnerability in ninenines gun (gunhttp2 module) allows cross-origin cookie injection via unvalidated HTTP/2 PUSHPROMISE authority.
In gunhttp2:pushpromiseframe/7, the :authority pseudo-header from an incoming PUSHPROMISE frame is stored verbatim into the promised stream record without checking that it matches the connection's origin. When gunhttp2:headersframe/9 later processes the response headers for the promised stream, it calls guncookies:setcookieheader/7 with the unvalidated server-supplied authority before any status branching and before user code can act. This violates RFC 7540 §10.6 / RFC 9113 §8.4, which require receivers to treat as a protocol error any push for a resource the server is not authoritative for.
A malicious or compromised HTTP/2 server can plant cookies scoped to arbitrary third-party domains into the client's shared cookie store. This enables session fixation attacks against those domains and, if the planted cookie overrides a legitimate session token, may result in account takeover. No user interaction beyond making a normal HTTP/2 request to the attacker-controlled server is required.
This issue affects gun: from 2.0.0 before 2.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gun_http2 module (gun)to a version that resolves this vulnerability.Fixed in 2.4.0 - Compensating control
Mitigate cross-origin cookie injection by preventing attackers from receiving HTTP/2 connections from clients you care about (e.g., restrict outbound/inbound HTTP/2 access with network controls so clients cannot connect to attacker-controlled HTTP/2 servers).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43972?
The severity of CVE-2026-43972 is medium with a CVSS score of 6.3.
How do I fix CVE-2026-43972?
To fix CVE-2026-43972, ensure that the :authority pseudo-header from incoming PUSH_PROMISE frames is properly validated against the connection origin.
What type of vulnerability is CVE-2026-43972?
CVE-2026-43972 is an Origin Validation Error vulnerability allowing cross-origin cookie injection.
Which software is affected by CVE-2026-43972?
CVE-2026-43972 affects the gun HTTP/2 module in the hex/gun software.
When was CVE-2026-43972 published?
CVE-2026-43972 was published on June 8, 2026.