EUVD-2026-41861Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, no auth or interaction, and low complexity to craft the HPACK integer; impact is availability-only (CPU/memory exhaustion) with no confidentiality or integrity effect, scope unchanged.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
1DescriptionCVE.org
Inefficient Algorithmic Complexity vulnerability in elixir-mint hpax allows unauthenticated denial-of-service via unbounded HPACK integer decoding.
hpax decodes HPACK variable-length integers with no upper bound on the decoded value or the number of continuation octets. 'Elixir.HPAX.Types':decode_remaining_integer/3 accumulates the integer as int + (value <<< m), shifting by 7 more bits for each continuation octet and stopping only on a terminating octet or truncated input, never because the integer grew too large. Because BEAM integers are arbitrary precision, a run of N continuation octets builds an O(N)-bit bignum and re-adds into an ever-larger bignum on each step, so the total decoding cost is superlinear (about O(N^2)). An unauthenticated attacker who can send an HTTP/2 header block to a server using this decoder (reached through the 'Elixir.HPAX':decode/2 entry point) can supply a small header block that forces a large, attacker-controlled amount of CPU (and transient memory), a denial-of-service amplification.
This issue affects hpax from 0.1.1 before 1.0.4.
AnalysisAI
Unauthenticated denial-of-service in elixir-mint's hpax (the HPACK header-compression library for Elixir HTTP/2, versions 0.1.1 through 1.0.3) allows a remote attacker to force superlinear (~O(N²)) CPU consumption by sending a small header block containing an HPACK integer with a long run of continuation octets. Because BEAM integers are arbitrary-precision, the decoder builds an ever-growing bignum with no upper bound, turning a few crafted bytes into a large, attacker-controlled amount of CPU and transient memory - a classic decompression/amplification DoS. No public exploit is identified at time of analysis and it is not in CISA KEV, but a vendor patch (version 1.0.4) is available.
Technical ContextAI
hpax implements HPACK (RFC 7541), the header-compression format used by HTTP/2, and is a foundational dependency in the Elixir networking stack (notably Mint and Finch-based clients/servers). The flaw sits in the variable-length integer decoder: 'Elixir.HPAX.Types':decode_remaining_integer/3 accumulates the value as int + (value <<< m), advancing the shift by 7 bits per continuation octet, and terminates only on a terminating octet or truncated input - never on a size threshold. Each continuation octet enlarges the running bignum, so re-adding into an O(N)-bit integer N times yields roughly O(N²) work. This is the textbook manifestation of CWE-407 (Inefficient Algorithmic Complexity), aggravated here by BEAM's arbitrary-precision integers which remove the natural 64-bit ceiling that would cap the cost in most languages. The reachable entry point is 'Elixir.HPAX':decode/2, invoked whenever a server or client parses an inbound HTTP/2 header block.
RemediationAI
Vendor-released patch: upgrade hpax to 1.0.4 or later, which bounds HPACK integer decoding; the fix is in commit 1ba4bb2dc91e80089cf89c73970ac3ded76f17eb (https://github.com/elixir-mint/hpax/commit/1ba4bb2dc91e80089cf89c73970ac3ded76f17eb) and described in advisory GHSA-jj2p-32j7-whj2. In mix.exs, update the hpax dependency constraint to ~> 1.0.4 and run mix deps.update hpax; note that hpax is usually a transitive dependency, so also confirm the resolved version in mix.lock and rebuild, since a pinned parent library may otherwise hold back an old hpax. If immediate patching is not possible, place the HTTP/2 endpoint behind a proxy or WAF that can cap request header size and reject oversized/abnormal HPACK header blocks, and/or constrain per-connection CPU/time and concurrent HTTP/2 streams to limit amplification - with the trade-off that aggressive header-size limits can break legitimate clients sending large cookies or auth tokens. Where HTTP/2 is not required, disabling HTTP/2 (falling back to HTTP/1.1) removes the reachable decode path at the cost of losing HTTP/2's multiplexing benefits.
Same weakness CWE-407 – Inefficient Algorithmic Complexity
View allShare
External POC / Exploit Code
Leaving vuln.today