CVE-2026-82729
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
Inefficient Algorithmic Complexity vulnerability in elixir-mint mint allows a remote HTTP server to exhaust CPU on the client host and cause a denial of service. parse_hex_prefix/2 in lib/mint/http1/parse.ex folds each hex digit of a chunked response's chunk-size field into an arbitrary-precision accumulator with acc * 16 + digit and imposes no limit on the digit count. Because the accumulator grows without bound, the multiplication is not constant time and one pass over N digits costs O(N squared). handle_data/2 prepends conn.buffer and re-parses from the start on every socket message, so a server that dribbles the digits out in small packets makes the client pay that cost repeatedly. A run of roughly 512,000 hex digits costs over ten seconds of CPU in a single pass, measured on stock defaults. The parser reaches this state after a valid status line and a complete, valid header section, so an intermediary inspecting only headers sees an ordinary 200 response. This issue affects mint: from 1.9.3 before 1.10.0.
Risk Assessment
The risk is the potential for a denial-of-service attack on the client by a remote server, which can lead to significant slowdown or hang of the client application. The attack can be easily exploited by a malicious server.
Recommendation
It is recommended to upgrade the mint library to version 1.10.0 or later, which includes a fix limiting the digit count. Also consider client-side limits for header field lengths.
Other vulnerabilities in elixir-mint
See all- CVE-2026-94194Medium
An HTTP Request/Response Smuggling vulnerability in elixir-mint allows a malicious HTTP/1 server to desynchronize an intermediary and the Mint client on a pooled connection, poisoning responses to subsequent requests sharing the connection. The issue stems from selecting chunked framing when chunked is not the final coding in Transfer-Encoding, and from keeping the connection open after an HTTP/1.0 response with Transfer-Encoding and Connection: keep-alive.
- CVE-2026-92103Medium
An Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint allows a malicious HTTP/2 server to make the client hold up to about 16 MiB per connection in frames it should reject. Mint compares a frame with max_frame_size only after the whole declared payload arrives, and a server can declare a length up to 16,777,215 bytes and withhold the last byte.
Original NVD description (English source)
Inefficient Algorithmic Complexity vulnerability in elixir-mint mint allows a remote HTTP server to exhaust CPU on the client host and cause a denial of service. parse_hex_prefix/2 in lib/mint/http1/parse.ex folds each hex digit of a chunked response's chunk-size field into an arbitrary-precision accumulator with acc * 16 + digit and imposes no limit on the digit count. Because the accumulator grows without bound, the multiplication is not constant time and one pass over N digits costs O(N squared). handle_data/2 prepends conn.buffer and re-parses from the start on every socket message, so a server that dribbles the digits out in small packets makes the client pay that cost repeatedly. A run of roughly 512,000 hex digits costs over ten seconds of CPU in a single pass, measured on stock defaults. The parser reaches this state after a valid status line and a complete, valid header section, so an intermediary inspecting only headers sees an ordinary 200 response. This issue affects mint: from 1.9.3 before 1.10.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS