The vulnerability is a server‑side origin validation failure in the gun HTTP/2 module. The :authority pseudo‑header from an incoming PUSH_PROMISE frame is stored without verifying it matches the connection's origin. This flaw allows a malicious or compromised HTTP/2 server to plant cookies that are scoped to third‑party domains into the client’s shared cookie store. An attacker can therefore perform session fixation or, if the injected cookie overrides a legitimate session token, achieve account takeover. No user interaction beyond a normal HTTP/2 request to the attacker‑controlled server is required.

The affected product is the Erlang library gun, specifically the gun_http2 module. All versions from 2.0.0 up to, but not including, 2.4.0 are vulnerable. No other vendors or product lines are affected according to the CNA data.

The CVSS score of 6.3 indicates moderate severity. EPSS information is not available, so the likelihood of exploitation is undetermined, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is any HTTP/2 request originating from an attacker‑controlled server to a client utilizing gun. An attacker does not need privileged access; simply serving a malicious PUSH_PROMISE frame with a forged :authority header suffices. Because the issue violates RFC 7540 §10.6, it is a protocol error and can be detected by compliant HTTP/2 peers.