CVE-2026-92103
MediumCVSS 6.3Summary
An Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint allows a malicious HTTP/2 server to make the client hold up to about 16 MiB per connection in frames it should reject. Mint compares a frame with max_frame_size only after the whole declared payload arrives, and a server can declare a length up to 16,777,215 bytes and withhold the last byte.
Risk Assessment
An attacker can consume client memory, potentially leading to resource exhaustion and denial of service. There is no amplification, but the buffer grows up to the 24-bit frame length limit.
Recommendation
Update the elixir-mint library to version 1.11.0 or later. Monitor memory usage of applications using Mint and consider connection limits.
Other vulnerabilities in elixir-mint
See all- CVE-2026-94194Medium
An HTTP Request/Response Smuggling vulnerability in elixir-mint allows a malicious HTTP/1 server to desynchronize an intermediary and the Mint client on a pooled connection, poisoning responses to subsequent requests sharing the connection. The issue stems from selecting chunked framing when chunked is not the final coding in Transfer-Encoding, and from keeping the connection open after an HTTP/1.0 response with Transfer-Encoding and Connection: keep-alive.
- CVE-2026-82729Medium
Inefficient Algorithmic Complexity vulnerability in elixir-mint mint allows a remote HTTP server to exhaust CPU on the client host and cause a denial of service. parse_hex_prefix/2 in lib/mint/http1/parse.ex folds each hex digit of a chunked response's chunk-size field into an arbitrary-precision accumulator with acc * 16 + digit and imposes no limit on the digit count. Because the accumulator grows without bound, the multiplication is not constant time and one pass over N digits costs O(N squared). handle_data/2 prepends conn.buffer and re-parses from the start on every socket message, so a server that dribbles the digits out in small packets makes the client pay that cost repeatedly. A run of roughly 512,000 hex digits costs over ten seconds of CPU in a single pass, measured on stock defaults. The parser reaches this state after a valid status line and a complete, valid header section, so an intermediary inspecting only headers sees an ordinary 200 response. This issue affects mint: from 1.9.3 before 1.10.0.
Original NVD description (English source)
Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to make the client hold up to about 16 MiB per connection in frames it should reject, consuming client memory. Mint.HTTP2.Frame.decode_next/2 in lib/mint/http2/frame.ex compares a frame with the client's max_frame_size (16,384 bytes by default) only once the whole declared payload has arrived. Until then it returns :more, and Mint.HTTP2 keeps every received byte in the connection buffer. A server can declare a frame length of up to 16,777,215 bytes and withhold the last byte, keeping roughly 1,024 times the advertised limit buffered for as long as the connection stays open. The server has to send every byte the client buffers, so there is no amplification, and the buffer stops at the 24-bit frame length limit. This issue affects mint: from 0.1.0 before 1.11.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS