CVE-2026-58226
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
An inefficient algorithmic complexity vulnerability in the hpax library for Elixir allows unauthenticated denial-of-service via unbounded HPACK integer decoding. An attacker can send a small HTTP/2 header block that forces excessive CPU and memory usage. This affects hpax versions from 0.1.1 before 1.0.4.
Risk Assessment
The organization is at risk of DoS attacks that can overwhelm the server and disrupt services even with low network traffic. The attack requires no authentication, increasing the risk for systems exposed to public HTTP/2 traffic.
Recommendation
Immediately upgrade the hpax library to version 1.0.4 or later. If an upgrade is not possible, consider temporarily disabling HTTP/2 support or applying WAF rules to mitigate malicious header blocks.
Original NVD description (English source)
Inefficient Algorithmic Complexity vulnerability in elixir-mint hpax allows unauthenticated denial-of-service via unbounded HPACK integer decoding. hpax decodes HPACK variable-length integers with no upper bound on the decoded value or the number of continuation octets. 'Elixir.HPAX.Types':decode_remaining_integer/3 accumulates the integer as int + (value <<< m), shifting by 7 more bits for each continuation octet and stopping only on a terminating octet or truncated input, never because the integer grew too large. Because BEAM integers are arbitrary precision, a run of N continuation octets builds an O(N)-bit bignum and re-adds into an ever-larger bignum on each step, so the total decoding cost is superlinear (about O(N^2)). An unauthenticated attacker who can send an HTTP/2 header block to a server using this decoder (reached through the 'Elixir.HPAX':decode/2 entry point) can supply a small header block that forces a large, attacker-controlled amount of CPU (and transient memory), a denial-of-service amplification. This issue affects hpax from 0.1.1 before 1.0.4.