EUVD-2026-88218Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable but requires luring the client to a malicious HTTP/2 server (reverse trust), so AC:H; no auth needed (PR:N); availability-only impact (A:H, C/I:N).
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
4DescriptionCVE.org
Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to exhaust memory on the client host and cause a denial of service.
Mint.HTTP2 enforces the client's max_header_list_size setting only on the compressed size of an inbound header block, while RFC 9113 section 6.5.2 defines the limit on the decoded header list. An HPACK indexed field costs one byte on the wire and decodes to a dynamic table entry of up to 4 KB, and join_cookie_headers/1 in lib/mint/http2.ex copies every cookie value of a response into one new binary. A header block under the default 256 KB wire limit therefore makes the client allocate about 1 GB for a single response, and several such responses in one delivery exhaust the memory of the process that owns the connection or of the whole VM.
This issue affects mint: from 1.1.0 before 1.11.0.
AnalysisAI
Memory exhaustion denial-of-service in Elixir Mint affects versions 1.1.0 through 1.10.x and allows a malicious or compromised HTTP/2 server to force a client application to allocate roughly 1 GB per response by abusing HPACK indexed header fields and cookie handling, potentially exhausting the BEAM VM. The vulnerability requires the application to initiate an outbound HTTP/2 connection to an attacker-influenced endpoint (reverse-trust), and no public exploit code or confirmed active exploitation is identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the Elixir application to initiate an HTTP/2 connection to an attacker-controlled or compromised server (reverse-trust) - the flaw cannot be triggered against a client that only speaks to trusted endpoints. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a reverse-trust denial-of-service: the attack signal set is uniformly moderate, not a top-tier priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Mint 1.11.0 or later; the vendor-released patch is in version 1.11.0, with fixes in commit 8e0e04680476f90f9f68db4dfeabcbe66dabfc4d and a patch commit c7895cb022196c77ec35570c8e873a84393ff4b8. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every application and service that depends on Mint versions 1.1.0 through 1.10.x, including transitive use through Finch and Req, and identify which make outbound HTTP/2 requests to third-party or otherwise untrusted endpoints; for the highest-risk internet-facing or customer-facing services, apply the patch available per the vendor advisory through an emergency change, and in the interim restrict outbound HTTP/2 egress to an allowlist of known-good hosts and enable memory-usage alerting on the affected BEAM nodes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unbounded recursion in the Elixir `protobuf` Hex package (versions >= 0.8.0, < 0.16.1) lets unauthenticated remote attac
Improper JWT signature verification in Dashbit's nimble_zta (0.1.2 up to but not including 0.1.3) lets an unauthenticate
Session-swapping authentication bypass in the Elixir library AshAuthentication (versions 4.10.0 before 4.15.0 and 5.0.0-
Authentication bypass in the Elixir library ash_authentication lets an attacker who operates one federated identity-prov
Account takeover in AshAuthentication (Elixir/Ash) 4.14.0 through 4.14.x and 5.0.0-rc.10 through 5.0.0-rc.13 lets unauth
Server-Side Request Forgery protection bypass in the Elixir safeurl library (versions 0.1.0 and later) allows unauthenti
Memory-exhaustion denial of service in the elixir-protobuf library (protobuf) from 0.8.0 onward allows an unauthenticate
Atom table exhaustion in the Ash framework (Elixir) allows an unauthenticated remote attacker to crash a BEAM node by su
Ciphertext tampering in the Cloak Elixir encryption library (danielberkompas/cloak, all versions from 0.1.0-pre onward)
Authentication bypass in the AshAuthentication library for Elixir/Ash lets an authenticated attacker who holds a valid s
An authenticated account-takeover primitive exists in the Elixir library AshAuthentication (ash_authentication) versions
Session fixation in the Elixir/Phoenix authentication library ash_authentication (0.2.0 before 4.15.0, and 5.0.0-rc.0 be
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today