https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-43974.htmlhttps://patchthecve.com/cve/CVE-2026-43974.htmlTue, 18 Aug 2026 15:44:36 +0000HIGH 7.5: Unexpected Status Code or Return Value vulnerability in ninenines gun (gun_http module) allows a malicious HTTP server to force the client into raw protocol mode via an unsolicited 101 Switching Protocols response. In gun_http:handle_inform/8, when a 101 Switching Protocols response is received ovehttps://patchthecve.com/cve/CVE-2026-43973.htmlhttps://patchthecve.com/cve/CVE-2026-43973.htmlTue, 18 Aug 2026 15:43:43 +0000HIGH 7.5: Uncontrolled Resource Consumption vulnerability in ninenines gun (gun_http module) allows a malicious server to exhaust client memory via unbounded HTTP/1.1 response buffering. In gun_http:handle/5, three clauses accumulate incoming TCP data into the connection's buffer field using binary concatenahttps://patchthecve.com/cve/CVE-2026-43972.htmlhttps://patchthecve.com/cve/CVE-2026-43972.htmlTue, 18 Aug 2026 15:42:54 +0000HIGH 7.2: Origin Validation Error vulnerability in ninenines gun (gun_http2 module) allows cross-origin cookie injection via unvalidated HTTP/2 PUSH_PROMISE authority. In gun_http2:push_promise_frame/7, the :authority pseudo-header from an incoming PUSH_PROMISE frame is stored verbatim into the promised stre