ninenines gun

• CVE-2026-43973 High 8.7 gun HTTP/1.1 response buffer has no size limit allowing server-controlled memory exhaustion 0.5%
• CVE-2026-43972 Medium 6.3 gun HTTP/2 PUSH_PROMISE authority not validated against connection origin allows cross-origin cookie injection 0.2%
• CVE-2026-43974 High 8.7 gun HTTP/1.1 client accepts unsolicited 101 Switching Protocols response allowing server-driven protocol hijack and OOM 0.5%