CVE-2026-59246
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
A vulnerability in the Mint library for Elixir allows a remote HTTP/2 server to exhaust client memory by sending an infinite stream of zero-length CONTINUATION frames. The header accumulation mechanism lacks proper protection against this attack, leading to denial of service (DoS).
Risk Assessment
An attacker can cause memory exhaustion and crash the application using the Mint library, resulting in service disruption. The risk is particularly high for applications vulnerable to redirects, SSRF, or man-in-the-middle attacks.
Recommendation
Immediately update the mint library to version 1.9.2 or later, which includes a fix for this vulnerability.
Other vulnerabilities in mint
See all- CVE-2026-59249Medium
A vulnerability in the Mint library (versions 0.1.0 through 1.9.2) allows HTTP response smuggling by accepting a plus/minus sign in the chunk-size line of Transfer-Encoding: chunked. A malicious HTTP/1 server can exploit this interpretation mismatch to poison the response queue on a shared keep-alive connection, causing subsequent requests to receive forged responses.
- CVE-2026-58229High
A vulnerability in the Mint library for Elixir allows a remote HTTP server to exhaust client memory and cause a denial of service (DoS). The HTTP header decoding functions accumulate headers without limits, and the parser has no cap on the number or size of headers, enabling an attacker to stream infinite header lines without a terminating blank line.
- CVE-2026-56810High
A vulnerability in the Mint library (Mint.HTTP1 module) allows a remote server to exhaust client memory by sending a chunked transfer-encoded response with a declared huge chunk size (e.g., 2 GiB) and slowly sending data without ever completing the chunk. The client buffers all received bytes without emitting them to the caller, leading to uncontrolled memory growth and out-of-memory conditions.
- CVE-2026-49754High
A vulnerability in the Mint library for Elixir allows an attacker-controlled HTTP/2 server to exhaust client memory via a CONTINUATION frame flood. There is no limit on the header accumulator size, leading to memory exhaustion and BEAM process death.
- CVE-2026-49753Medium
Elixir Mint library before version 1.9.0 is vulnerable to HTTP response smuggling. The Content-Length parser accepts + and - signs, violating RFC 7230. An attacker-controlled HTTP/1 server can desynchronize response framing on shared connections.
- CVE-2026-48862High
A vulnerability in the Mint library for Elixir allows an attacker-controlled HTTP/2 server to exhaust client memory via PUSH_PROMISE flooding. The server can create an unlimited number of stream entries without checking the max_concurrent_streams limit, leading to memory exhaustion.
- CVE-2026-48861Low
Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in elixir-mint Mint allows HTTP Request Splitting and HTTP Request Smuggling. In lib/mint/http1/request.ex, the encode_request_line/2 function splices the caller-supplied method and target arguments directly into the HTTP/1 request line without any character validation. An application that forwards attacker-controlled input as the HTTP method or target to Mint.HTTP.request/5 is therefore exposed to request-line CRLF injection. Mint 1.7.0 introduced validate_request_target/2, which rejects CRLF and other control characters in the target by default, but the method field remains unvalidated.
Original NVD description (English source)
Allocation of resources without limits vulnerability in elixir-mint mint allows a remote HTTP/2 server to exhaust memory on the client host and cause a denial of service. The Mint.HTTP2.handle_continuation/3 function in lib/mint/http2.ex accumulates the header-block fragment carried by each HTTP/2 CONTINUATION frame into a growing conn.headers_being_processed nesting, one level deeper per frame, and only releases it when a frame with the END_HEADERS flag arrives. The only guard on this accumulator is Mint.HTTP2.assert_header_block_within_max_size/2, which sums the byte size of the fragments received so far. Because a CONTINUATION frame is permitted by the protocol to carry a zero-length payload, an unbounded chain of zero-length CONTINUATION frames adds no bytes to the running total, never trips the size cap, and never emits END_HEADERS, yet each frame still nests the accumulator one level deeper. A malicious HTTP/2 server (reachable directly, via an attacker-controlled redirect, via SSRF, or via a man-in-the-middle) can open a stream by sending a HEADERS frame without END_HEADERS and then stream zero-length CONTINUATION frames indefinitely. Client memory grows one cons cell per frame received; sustained bandwidth from the peer drives the BEAM node running the Mint client to memory exhaustion and eventual out-of-memory termination. This issue affects mint: from 0.1.0 before 1.9.2.