CVE-2026-43972: 
Linux Fedora vulnerability analysis and mitigation

CVE-2026-43972 is an Origin Validation Error (CWE-346) in the gun_http2 module of ninenines gun, an Erlang HTTP/2 client library, that allows cross-origin cookie injection via unvalidated HTTP/2 PUSH_PROMISE authority. A malicious or compromised HTTP/2 server can plant cookies scoped to arbitrary third-party domains into the client's shared cookie store, enabling session fixation and potential account takeover. The vulnerability affects gun versions 2.0.0 through 2.3.x (before 2.4.0) and was disclosed on June 8, 2026. It carries a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an origin validation failure (CWE-346) in gun_http2:push_promise_frame/7, where the :authority pseudo-header from an incoming PUSH_PROMISE frame is stored verbatim into the promised stream record without verifying that it matches the connection's established origin. Subsequently, when gun_http2:headers_frame/9 processes response headers for the promised stream, it invokes gun_cookies:set_cookie_header/7 using the unvalidated server-supplied authority — before any status branching or user-code intervention — causing cookies to be set for an attacker-controlled domain. This behavior violates RFC 7540 §10.6 and RFC 9113 §8.4, which mandate that receivers treat pushes for resources the server is not authoritative for as protocol errors. The fix, committed at 567863ff, adds an explicit check comparing the promised stream's scheme and authority against the original request's connection origin, sending a PROTOCOL_ERROR RST_STREAM for mismatched pushes (GitHub Commit, GitHub Advisory).

A successful exploit allows an attacker controlling or compromising an HTTP/2 server to inject cookies scoped to arbitrary third-party domains into the client's shared cookie store without any user interaction beyond a normal HTTP/2 request. This enables session fixation attacks against those third-party domains, and if the injected cookie overrides a legitimate session token, can result in account takeover. Confidentiality of the vulnerable system itself is not directly impacted, but subsequent systems (third-party domains sharing the cookie store) face low-to-moderate integrity and confidentiality risks (GitHub Advisory, Red Hat Bugzilla).

1. Set up a malicious HTTP/2 server: The attacker operates or compromises an HTTP/2 server that a target application using ninenines gun (versions 2.0.0–2.3.x) connects to.
2. Receive the client's HEADERS frame: Wait for the client to initiate a normal HTTP/2 request (e.g., GET /), which sends a HEADERS frame to the server.
3. Send a crafted PUSH_PROMISE frame: Respond with a PUSH_PROMISE frame containing a :authority pseudo-header set to an arbitrary third-party domain (e.g., gun.test or victim-bank.com) rather than the server's own origin. The :scheme, :method, and :path headers are set to valid values for the spoofed domain.
4. Trigger cookie injection: When gun processes the subsequent HEADERS frame for the promised stream, gun_cookies:set_cookie_header/7 is called with the attacker-supplied authority, causing cookies (e.g., Set-Cookie: session=attacker_value; Domain=victim-bank.com) to be stored in the client's shared cookie store scoped to the third-party domain.
5. Achieve session fixation: The next time the client makes a request to the targeted third-party domain, the injected cookie is sent, potentially overriding a legitimate session token and enabling account takeover (GitHub Commit, GitHub Advisory).

• Network: HTTP/2 PUSH_PROMISE frames from a server containing :authority values that differ from the connection's established origin; outbound RST_STREAM frames with PROTOCOL_ERROR (error code 1) from a patched client rejecting invalid pushes.
• Logs: Application logs showing unexpected cookie values being set for domains not matching the connected server; gun debug logs referencing gun_push events with mismatched authority fields.
• Behavior: Client applications authenticating to third-party services with unexpected or attacker-controlled session tokens; session fixation symptoms such as forced re-authentication or unauthorized access on domains the client did not directly contact.

Upgrade ninenines gun to version 2.4.0 or later, which includes the fix that validates the :authority pseudo-header in PUSH_PROMISE frames against the connection's origin before processing cookies (GitHub Commit, GitHub Advisory). As a temporary workaround until patching is feasible, restrict HTTP/2 connections to only trusted, verified servers and consider disabling HTTP/2 server push if the application does not require it. Fedora packages for erlang/cowlib have also been updated to address this issue (Linux Security).

Red Hat triaged the issue as urgent severity and opened a tracking bug (BZ#2486373) shortly after disclosure on June 8, 2026 (Red Hat Bugzilla). Fedora issued advisories for updated erlang/cowlib packages for Fedora 43 and 44 to address the dependency (Linux Security). No significant broader media coverage or notable researcher commentary beyond standard vulnerability tracking has been observed.