EUVD-2026-43643Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires client connection to an attacker-controlled HTTP/2 server (AC:H); successful exploitation fully terminates the BEAM process (A:H); no confidentiality or integrity impact.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
2DescriptionCVE.org
Allocation of resources without limits vulnerability in elixir-mint mint allows a remote HTTP/2 server to exhaust memory on the client host and cause a denial of service.
The Mint.HTTP2.handle_continuation/3 function in lib/mint/http2.ex accumulates the header-block fragment carried by each HTTP/2 CONTINUATION frame into a growing conn.headers_being_processed nesting, one level deeper per frame, and only releases it when a frame with the END_HEADERS flag arrives. The only guard on this accumulator is Mint.HTTP2.assert_header_block_within_max_size/2, which sums the byte size of the fragments received so far. Because a CONTINUATION frame is permitted by the protocol to carry a zero-length payload, an unbounded chain of zero-length CONTINUATION frames adds no bytes to the running total, never trips the size cap, and never emits END_HEADERS, yet each frame still nests the accumulator one level deeper.
A malicious HTTP/2 server (reachable directly, via an attacker-controlled redirect, via SSRF, or via a man-in-the-middle) can open a stream by sending a HEADERS frame without END_HEADERS and then stream zero-length CONTINUATION frames indefinitely. Client memory grows one cons cell per frame received; sustained bandwidth from the peer drives the BEAM node running the Mint client to memory exhaustion and eventual out-of-memory termination.
This issue affects mint: from 0.1.0 before 1.9.2.
AnalysisAI
Memory exhaustion in elixir-mint's HTTP/2 client library (mint) allows a malicious or attacker-controlled HTTP/2 server to crash any BEAM application using the library by streaming unbounded zero-length CONTINUATION frames that bypass the existing byte-size guard. Affected versions span mint 0.1.0 through 1.9.1; a vendor-released patch is confirmed in 1.9.2. No public exploit or CISA KEV listing exists at time of analysis, but the explicit SSRF and redirect attack vectors meaningfully increase realistic exposure for server-side Elixir applications that proxy user-supplied URLs.
Technical ContextAI
The vulnerability resides in Mint.HTTP2.handle_continuation/3 (lib/mint/http2.ex) within the elixir-mint/mint Elixir HTTP/2 client library (CPE: cpe:2.3:a:elixir-mint:mint). The root cause is CWE-770 (Allocation of Resources Without Limits): the function accumulates HTTP/2 CONTINUATION frame header-block fragments into a nested conn.headers_being_processed iodata cons-cell list, releasing it only when a frame bearing the END_HEADERS flag arrives. The sole resource guard, assert_header_block_within_max_size/2, enforces a byte-count ceiling - but because the HTTP/2 protocol permits zero-length CONTINUATION payloads, zero-byte frames contribute nothing to the running byte total, never trigger the cap, and never emit END_HEADERS, yet each still appends one cons-cell nesting level. The BEAM VM heap therefore grows monotonically, one allocation per frame, until the operating system terminates the Erlang node for OOM. The patch (commit 5779de1) adds an early-return branch that silently discards zero-length fragments without updating the accumulator, and the accompanying regression test confirms 10,000 consecutive empty frames no longer grow the structure.
RemediationAI
Upgrade elixir-mint/mint to version 1.9.2 or later, which contains patch commit 5779de1666344b32aefc4354184ea07f902f73ce; the patch and advisory are at https://github.com/elixir-mint/mint/commit/5779de1666344b32aefc4354184ea07f902f73ce and https://github.com/elixir-mint/mint/security/advisories/GHSA-8pf6-g464-h6h9 respectively. Applications using Finch or other mint wrappers must also bump those dependencies to versions that pull in mint 1.9.2 transitively. If immediate upgrade is not feasible, restrict outbound HTTP/2 connections to an allowlist of trusted server hostnames at the network or application layer - this eliminates the redirect, SSRF, and MitM vectors at the cost of blocking access to non-allowlisted endpoints. Alternatively, forcing HTTP/1.1-only connections (where mint's API exposes that option) removes the CONTINUATION frame attack surface entirely but sacrifices HTTP/2 multiplexing. Neither workaround addresses direct malicious-server connections if those are part of the application's intended use.
Memory exhaustion in the Elixir Mint HTTP/2 client (versions 0.1.0 through 1.8.x) allows a malicious or compromised HTTP
Memory exhaustion in elixir-mint Mint HTTP/2 client (versions 0.2.0 through 1.8.x) allows a malicious HTTP/2 server to c
HTTP response smuggling in the Elixir Mint HTTP client library (versions 0.1.0 through before 1.9.0) allows attacker-con
Uncontrolled memory allocation in the Elixir Mint HTTP client (Mint.HTTP1 module, versions 0.5.0 through 1.9.0) lets a m
Unbounded memory accumulation in the elixir-mint Mint HTTP client library (versions 0.1.0 through <1.10.0) enables a rem
Unbounded memory consumption in the Elixir Mint HTTP client (versions 0.1.0 through 1.9.1) lets a malicious or attacker-
CPU exhaustion via crafted chunked HTTP responses affects the Elixir Mint HTTP client library (versions 1.9.3 through be
Response-queue poisoning in the elixir-mint Mint HTTP/1.1 client library (versions 0.1.0 through before 1.9.3) allows a
CRLF injection in the elixir-mint Mint HTTP/1.1 client library (versions 0.1.0 through 1.8.x) enables HTTP Request Split
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today