EUVD-2026-43642Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network DoS with no auth or interaction, but the client must be steered to attacker-controlled content, so AC:H; impact is availability-only (A:H, C/I:N).
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
3DescriptionCVE.org
Allocation of resources without limits vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client host and cause a denial of service.
The Mint.HTTP1.decode_headers/5 and Mint.HTTP1.decode_trailer_headers/4 functions in lib/mint/http1.ex accumulate every parsed response header and chunked-trailer field into a per-request list that persists across incoming TCP segments as request.headers_buffer, and only clear it when the terminating blank line is received. The section has no cap on the number of headers or on total bytes, and the underlying :erlang.decode_packet(:httph_bin, binary, []) parser is invoked with an empty option list so its per-line and per-packet size limits also default to unlimited.
A malicious HTTP server (reachable directly, via an attacker-controlled redirect, via SSRF, or via a man-in-the-middle) can stream complete header lines (or, after a chunked body, complete trailer lines) indefinitely without ever emitting the terminating blank line. The connection state grows without bound until the BEAM node is killed by the operating system's out-of-memory handler, taking down the entire application that uses Mint as an HTTP client.
This issue affects mint: from 0.1.0 before 1.9.2.
AnalysisAI
Unbounded memory consumption in the Elixir Mint HTTP client (versions 0.1.0 through 1.9.1) lets a malicious or attacker-influenced HTTP server crash the entire BEAM application acting as the client. The HTTP/1 header and chunked-trailer parsers accumulate every incoming header line into a per-request buffer with no size or count cap, so a server that streams headers forever without sending the terminating blank line drives the client host to out-of-memory death. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor patch (1.9.2) and fix commit are available, and the EPSS/POC signals are unremarked in the source data.
Technical ContextAI
Mint is a low-level, process-less HTTP/1 and HTTP/2 client library for Elixir/Erlang; it is widely embedded beneath higher-level clients (e.g. Finch/Req). The flaw is CWE-770 (Allocation of Resources Without Limits or Throttling). In lib/mint/http1.ex, Mint.HTTP1.decode_headers/5 and decode_trailer_headers/4 append each parsed header or trailer field to request.headers_buffer, which persists across TCP segments and is only reset when a blank line signals the end of the header section. Neither a header count nor a byte cap is enforced, and the parser call :erlang.decode_packet(:httph_bin, binary, []) passes an empty option list, so BEAM's own per-line and per-packet size limits also default to unlimited. The result is unbounded connection-state growth on the client.
RemediationAI
Upgrade Mint to the fixed release: Vendor-released patch: 1.9.2, which introduces a :max_header_list_size option (positive integer of bytes or :infinity) defaulting to 256 KiB that caps the combined size of a response header section or chunked trailer section and returns a {:max_header_list_size_exceeded, size, max_size} error instead of buffering without bound (fix commit https://github.com/elixir-mint/mint/commit/566d702e6f29105f77522ca7aabb9f64f2f4e333). After upgrading, environments handling large legitimate header sets can tune :max_header_list_size upward, accepting proportionally higher memory exposure. If immediate upgrade is not possible, reduce exposure by not following redirects to untrusted hosts, restricting outbound connections from Mint-based clients to an allowlist of trusted servers to blunt SSRF and MITM vectors, and enforcing per-process memory limits or supervision so a runaway connection is killed before it takes down the BEAM node; these controls limit but do not eliminate the unbounded-buffer behavior. Full details are in advisory GHSA-qrfr-wh4c-3qhw.
Memory exhaustion in the Elixir Mint HTTP/2 client (versions 0.1.0 through 1.8.x) allows a malicious or compromised HTTP
Memory exhaustion in elixir-mint Mint HTTP/2 client (versions 0.2.0 through 1.8.x) allows a malicious HTTP/2 server to c
HTTP response smuggling in the Elixir Mint HTTP client library (versions 0.1.0 through before 1.9.0) allows attacker-con
Uncontrolled memory allocation in the Elixir Mint HTTP client (Mint.HTTP1 module, versions 0.5.0 through 1.9.0) lets a m
Unbounded memory accumulation in the elixir-mint Mint HTTP client library (versions 0.1.0 through <1.10.0) enables a rem
CPU exhaustion via crafted chunked HTTP responses affects the Elixir Mint HTTP client library (versions 1.9.3 through be
Memory exhaustion in elixir-mint's HTTP/2 client library (mint) allows a malicious or attacker-controlled HTTP/2 server
Response-queue poisoning in the elixir-mint Mint HTTP/1.1 client library (versions 0.1.0 through before 1.9.3) allows a
CRLF injection in the elixir-mint Mint HTTP/1.1 client library (versions 0.1.0 through 1.8.x) enables HTTP Request Split
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today