https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 05:01:27 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-325583 EUVD-2026-325583 https://cve.radiocsirt.org/vuln/euvd-2026-325583 https://cve.radiocsirt.org/vuln/fkie_cve-2026-43972 <p>Origin Validation Error vulnerability in ninenines gun (gun_http2 module) allows cross-origin cookie injection via unvalidated HTTP/2 PUSH_PROMISE authority.</p> <p>In gun_http2:push_promise_frame/7, the :authority pseudo-header from an incoming PUSH_PROMISE frame is stored verbatim into the promised stream record without checking that it matches the connection&#39;s origin. When gun_http2:headers_frame/9 later processes the response headers for the promised stream, it calls gun_cookies:set_cookie_header/7 with the unvalidated server-supplied authority before any status branching and before user code can act. This violates RFC 7540 §10.6 / RFC 9113 §8.4, which require receivers to treat as a protocol error any push for a resource the server is not authoritative for.</p> <p>A malicious or compromised HTTP/2 server can plant cookies scoped to arbitrary third-party domains into the client&#39;s shared cookie store. This enables session fixation attacks against those domains and, if the planted cookie overrides a legitimate session token, may result in account takeover. No user interaction beyond making a normal HTTP/2 request to the attacker-controlled server is required.</p> <p>This issue affects gun: from 2.0.0 before 2.4.0.</p> <p>Origin Validation Error vulnerability in ninenines gun (gun_http2 module) allows cross-origin cookie injection via unvalidated HTTP/2 PUSH_PROMISE authority.</p> <p>In gun_http2:push_promise_frame/7, the :authority pseudo-header from an incoming PUSH_PROMISE frame is stored verbatim into the promised stream record without checking that it matches the connection&#39;s origin. When gun_http2:headers_frame/9 later processes the response headers for the promised stream, it calls gun_cookies:set_cookie_header/7 with the unvalidated server-supplied authority before any status branching and before user code can act. This violates RFC 7540 §10.6 / RFC 9113 §8.4, which require receivers to treat as a protocol error any push for a resource the server is not authoritative for.</p> <p>A malicious or compromised HTTP/2 server can plant cookies scoped to arbitrary third-party domains into the client&#39;s shared cookie store. This enables session fixation attacks against those domains and, if the planted cookie overrides a legitimate session token, may result in account takeover. No user interaction beyond making a normal HTTP/2 request to the attacker-controlled server is required.</p> <p>This issue affects gun: from 2.0.0 before 2.4.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-43972 https://cve.radiocsirt.org/vuln/ghsa-36w4-95hv-5vwg <p><strong>Affected:</strong> Hex: gun</p> <p>Origin Validation Error vulnerability in ninenines gun (gun_http2 module) allows cross-origin cookie injection via unvalidated HTTP/2 PUSH_PROMISE authority.</p> <p>In gun_http2:push_promise_frame/7, the :authority pseudo-header from an incoming PUSH_PROMISE frame is stored verbatim into the promised stream record without checking that it matches the connection&#39;s origin. When gun_http2:headers_frame/9 later processes the response headers for the promised stream, it calls gun_cookies:set_cookie_header/7 with the unvalidated server-supplied authority before any status branching and before user code can act. This violates RFC 7540 §10.6 / RFC 9113 §8.4, which require receivers to treat as a protocol error any push for a resource the server is not authoritative for.</p> <p>A malicious or compromised HTTP/2 server can plant cookies scoped to arbitrary third-party domains into the client&#39;s shared cookie store. This enables session fixation attacks against those domains and, if the planted cookie overrides a legitimate session token, may result in account takeover. No user interaction beyond making a normal HTTP/2 request to the attacker-controlled server is required.</p> <p>This issue affects gun: from 2.0.0 before 2.4.0.</p> <p><strong>Affected:</strong> Hex: gun</p> <p>Origin Validation Error vulnerability in ninenines gun (gun_http2 module) allows cross-origin cookie injection via unvalidated HTTP/2 PUSH_PROMISE authority.</p> <p>In gun_http2:push_promise_frame/7, the :authority pseudo-header from an incoming PUSH_PROMISE frame is stored verbatim into the promised stream record without checking that it matches the connection&#39;s origin. When gun_http2:headers_frame/9 later processes the response headers for the promised stream, it calls gun_cookies:set_cookie_header/7 with the unvalidated server-supplied authority before any status branching and before user code can act. This violates RFC 7540 §10.6 / RFC 9113 §8.4, which require receivers to treat as a protocol error any push for a resource the server is not authoritative for.</p> <p>A malicious or compromised HTTP/2 server can plant cookies scoped to arbitrary third-party domains into the client&#39;s shared cookie store. This enables session fixation attacks against those domains and, if the planted cookie overrides a legitimate session token, may result in account takeover. No user interaction beyond making a normal HTTP/2 request to the attacker-controlled server is required.</p> <p>This issue affects gun: from 2.0.0 before 2.4.0.</p> https://cve.radiocsirt.org/vuln/ghsa-36w4-95hv-5vwg