EUVD-2026-41862Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable via any outbound request to a malicious server, no auth or interaction, low complexity; impact is availability-only memory exhaustion, so C:N/I:N/A:H with unchanged scope.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
1DescriptionCVE.org
Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint (Mint.HTTP1 module) allows a denial of service via an oversized chunked transfer-encoded response.
This vulnerability is associated with program files lib/mint/http1.ex and program routines 'Elixir.Mint.HTTP1':decode_body/5, 'Elixir.Mint.HTTP1':add_body_to_buffer/2.
When Mint decodes a chunked HTTP response body, it accumulates each partial fragment of the current chunk in the connection's data_buffer (an unbounded iolist) via add_body_to_buffer/2 and does not emit the data to the caller until the full declared chunk length has been received. The chunk size is taken directly from the server and parsed with no upper bound, so a malicious or compromised server can announce one enormous chunk (for example a size line of 7FFFFFFF, about 2 GiB) and then send the body bytes slowly without ever completing the chunk. The client buffers every received byte while it waits for a completion that never arrives, and because no data responses are produced until the chunk finishes, a caller that otherwise streams large content-length bodies safely gains no protection. An unauthenticated remote server (reachable whenever a client follows redirects, fetches user-supplied URLs, or processes webhooks) can drive the client's memory arbitrarily high and trigger an out-of-memory condition.
This issue affects mint: from 0.5.0 before 1.9.1.
AnalysisAI
Uncontrolled memory allocation in the Elixir Mint HTTP client (Mint.HTTP1 module, versions 0.5.0 through 1.9.0) lets a malicious or compromised HTTP server exhaust a client's memory and force an out-of-memory crash. When decoding a chunked response, Mint buffers every byte of the current chunk in an unbounded iolist and withholds it from the caller until the full declared chunk length arrives, so a server that advertises a huge chunk size (e.g. 0x7FFFFFFF ≈ 2 GiB) and then dribbles bytes slowly drives client memory arbitrarily high. This CWE-770 flaw is a denial-of-service only (VA:H, no confidentiality or integrity impact) with no public exploit identified at time of analysis and no CISA KEV listing.
Technical ContextAI
Mint is a low-level, process-less HTTP/1 and HTTP/2 client library for Elixir/Erlang that underpins higher-level clients such as Finch, Req, Tesla, and Swoosh. The defect lives in lib/mint/http1.ex within decode_body/5 and add_body_to_buffer/2: for HTTP/1.1 chunked transfer-encoding, each partial fragment of the in-progress chunk is accumulated into the connection's data_buffer, and no data response is emitted to the caller until the entire chunk (per its declared size line) is received. The chunk-size line is parsed straight from the server with no upper bound, so the buffer size is attacker-controlled. This is a textbook CWE-770 (Allocation of Resources Without Limits or Throttling): existing safeguards that protect streaming of large Content-Length bodies do not apply because chunk decoding never yields intermediate data. The CPE cpe:2.3:a:elixir-mint:mint:*:*:* identifies the affected package.
RemediationAI
Upgrade to Mint 1.9.1 or later, which is the vendor-released patched version (fix commit 193ce714907d16e8adc4ab3c40e4f0c2f045b2a6); update your mix.exs dependency and rebuild, and bump any transitive pins so libraries like Finch, Req, or Tesla resolve to the fixed Mint. Because downstream libraries vendor Mint transitively, run 'mix deps.update mint' and verify 'mix deps.tree' shows >= 1.9.1. Where immediate patching is not possible, reduce exposure by restricting which hosts the client may contact - disable or bound automatic redirect-following, validate and allowlist user-supplied fetch URLs, and avoid fetching arbitrary attacker-controlled endpoints; note these controls limit but do not fully eliminate the memory-exhaustion path, since any reachable malicious server can still trigger it. Consult the advisory at https://github.com/elixir-mint/mint/security/advisories/GHSA-c59h-fq4p-r36r for details.
Memory exhaustion in the Elixir Mint HTTP/2 client (versions 0.1.0 through 1.8.x) allows a malicious or compromised HTTP
Memory exhaustion in elixir-mint Mint HTTP/2 client (versions 0.2.0 through 1.8.x) allows a malicious HTTP/2 server to c
HTTP response smuggling in the Elixir Mint HTTP client library (versions 0.1.0 through before 1.9.0) allows attacker-con
Unbounded memory accumulation in the elixir-mint Mint HTTP client library (versions 0.1.0 through <1.10.0) enables a rem
Unbounded memory consumption in the Elixir Mint HTTP client (versions 0.1.0 through 1.9.1) lets a malicious or attacker-
CPU exhaustion via crafted chunked HTTP responses affects the Elixir Mint HTTP client library (versions 1.9.3 through be
Memory exhaustion in elixir-mint's HTTP/2 client library (mint) allows a malicious or attacker-controlled HTTP/2 server
Response-queue poisoning in the elixir-mint Mint HTTP/1.1 client library (versions 0.1.0 through before 1.9.3) allows a
CRLF injection in the elixir-mint Mint HTTP/1.1 client library (versions 0.1.0 through 1.8.x) enables HTTP Request Split
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today