Elixir Mint CVE-2026-82729

The victim application must initiate an outgoing HTTP/1.1 connection to a server controlled or influenced by the attacker. The server must respond with HTTP/1.1 chunked transfer encoding (Transfer-Encoding: chunked) and stream an oversized chunk-size hex field. Applications that accept user-supplied URLs, act as HTTP proxy clients, or consume third-party APIs over HTTP/1.1 are most exposed. The CVSS 4.0 AT:P metric confirms the attack requirement: the attacker cannot initiate the connection - the client must reach out. Exploitation is limited to: (1) outbound HTTP/1.1 connections (HTTP/2 and HTTPS to pinned certificates are unaffected unless the server itself is compromised), (2) Mint versions 1.9.3 through pre-1.10.0, and (3) scenarios where the attacker controls or can intercept responses from the upstream server. Applications making requests exclusively to known-good, operator-controlled servers over TLS with certificate validation are not realistically at risk.

The CVSS 4.0 score of 6.3 reflects a moderate, client-side DoS with AT:P (attack requirements present), meaning exploitation is contingent on the victim application connecting to an attacker-controlled server - a non-trivial precondition that reduces real-world risk relative to a straightforward inbound server vulnerability. VA:L (low availability impact on the vulnerable system) is conservatively scored; in practice, the CPU exhaustion described (10+ seconds per large payload, compoundable) could fully starve a single-threaded Elixir process or degrade a pool under load, suggesting the real availability impact may be higher than the score implies. Applications most at risk are those that make outbound HTTP/1.1 requests to user-supplied URLs, act as reverse-proxy clients, or connect to third-party services that could themselves be compromised. Applications with a fixed set of known-good upstream HTTPS servers face negligible risk unless those servers are compromised. No KEV listing and no POC code have been identified; EPSS was not provided in the source data. The risk-to-patch ratio strongly favors upgrading, given the fix is a one-line digit-count guard with no behavioral impact on valid responses.

An attacker operates a malicious HTTP server (or compromises a legitimate one) that victim Elixir applications connect to via Mint. When the victim requests a resource, the server responds with a valid 200 status and headers - indistinguishable from a legitimate response to any inspection layer - then streams a chunk-size field containing hundreds of thousands of hex digits one byte per TCP packet. Each arriving byte triggers a full re-parse of the accumulated buffer, compounding O(N²) bignum multiplications until the client's CPU is exhausted. No POC code has been publicly identified, but the advisory provides sufficient technical detail to reproduce the condition.