Mint
Monthly
Memory exhaustion denial-of-service in Elixir Mint affects versions 1.1.0 through 1.10.x and allows a malicious or compromised HTTP/2 server to force a client application to allocate roughly 1 GB per response by abusing HPACK indexed header fields and cookie handling, potentially exhausting the BEAM VM. The vulnerability requires the application to initiate an outbound HTTP/2 connection to an attacker-influenced endpoint (reverse-trust), and no public exploit code or confirmed active exploitation is identified at time of analysis. Downstream clients such as Finch and Req that use Mint are also affected when making outbound HTTP/2 requests to untrusted servers.
Unbounded memory accumulation in the elixir-mint Mint HTTP client library (versions 0.1.0 through <1.10.0) enables a remote HTTP server to exhaust client-side memory and crash the entire BEAM VM node. Two HTTP/1 parser states - the status-line decoder and the chunk-extension-line decoder - append successive socket data into `conn.buffer` with no size cap because the existing `:max_header_list_size` guard was wired only to header and trailer parsing, not to these two states. A malicious or attacker-redirected server that withholds CRLF terminators can grow the buffer indefinitely until the OS OOM-killer terminates the node, collaterally killing all other processes sharing it. No public exploit has been identified, but the technique requires only a straightforward streaming server.
Unbounded memory consumption in the Elixir Mint HTTP client (versions 0.1.0 through 1.9.1) lets a malicious or attacker-influenced HTTP server crash the entire BEAM application acting as the client. The HTTP/1 header and chunked-trailer parsers accumulate every incoming header line into a per-request buffer with no size or count cap, so a server that streams headers forever without sending the terminating blank line drives the client host to out-of-memory death. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor patch (1.9.2) and fix commit are available, and the EPSS/POC signals are unremarked in the source data.
Uncontrolled memory allocation in the Elixir Mint HTTP client (Mint.HTTP1 module, versions 0.5.0 through 1.9.0) lets a malicious or compromised HTTP server exhaust a client's memory and force an out-of-memory crash. When decoding a chunked response, Mint buffers every byte of the current chunk in an unbounded iolist and withholds it from the caller until the full declared chunk length arrives, so a server that advertises a huge chunk size (e.g. 0x7FFFFFFF ≈ 2 GiB) and then dribbles bytes slowly drives client memory arbitrarily high. This CWE-770 flaw is a denial-of-service only (VA:H, no confidentiality or integrity impact) with no public exploit identified at time of analysis and no CISA KEV listing.
Memory exhaustion in the Elixir Mint HTTP/2 client (versions 0.1.0 through 1.8.x) allows a malicious or compromised HTTP/2 server to crash the client's BEAM process via a CONTINUATION frame flood. The client's receive path buffers HEADERS and CONTINUATION fragments into an unbounded accumulator because SETTINGS_MAX_HEADER_LIST_SIZE defaulted to :infinity and was only enforced on outbound requests, so a single attacker-controlled endpoint can force unlimited iolist growth until the process dies. No public exploit identified at time of analysis, but a verified upstream patch and detailed advisory exist.
Memory exhaustion in elixir-mint Mint HTTP/2 client (versions 0.2.0 through 1.8.x) allows a malicious HTTP/2 server to crash the client process by flooding PUSH_PROMISE frames without follow-up HEADERS, since reserved stream entries bypass the max_concurrent_streams cap. CVSS 4.0 score is 8.2 with attack vector network and high availability impact, but no public exploit is identified at time of analysis and the bug requires the client to connect to a hostile server. Server push is accepted by default (enable_push=true), so any Mint-based HTTP client reaching an attacker-controlled origin is exposed.
HTTP/1 response smuggling in the Elixir Mint client (0.1.0 through 1.10.x) allows a malicious or attacker-influenced origin server to desynchronize Mint from an upstream intermediary on a pooled keep-alive connection, so that bytes following a crafted response are parsed as the answer to a subsequent request, poisoning that request's response. The root cause is that Mint's message_body/1 selects chunked framing whenever 'chunked' is the FIRST coding in a Transfer-Encoding header (e.g. 'Transfer-Encoding: chunked, gzip') instead of requiring it to be the final coding, and additionally keeps the connection open after an HTTP/1.0 response - final or 1xx - that carries Transfer-Encoding with 'Connection: keep-alive', both contrary to RFC 9112. Exploitation is a reverse-trust scenario: the attacker must control or inject server response framing and the client must reuse an HTTP/1 connection; HTTP/2 and non-pooled connections are unaffected, and no public exploit code or active exploitation was identified at time of analysis. The issue is fixed in Mint 1.11.0.
Memory exhaustion in the Elixir Mint HTTP/2 client (mint 0.1.0 through 1.10.x) lets a malicious or man-in-the-middle HTTP/2 server pin roughly 16 MiB of client buffer memory per open connection by declaring an oversized frame and withholding its final byte. The weakness is an unbounded resource allocation issue (CWE-770) in Mint.HTTP2.Frame.decode_next/2, which only checks a frame against the client's 16,384-byte max_frame_size after the entire declared payload has arrived, causing the connection buffer to keep accumulating bytes up to the 24-bit frame-length ceiling of 16,777,215 bytes. Impact is availability-only and low severity per the independent assessment: there is no amplification because the attacker must transmit every byte the client buffers, sustained denial of service requires many concurrently held connections plus matching attacker resources, and no public exploit identified at time of analysis, with no CISA KEV listing and no EPSS signal supplied. Attacker control of the server side is required (unauthenticated from the client's perspective, reflected as AT:P), and vendor patches are available in mint 1.11.0.
Chunked-response smuggling in the Elixir Mint HTTP client (0.1.0 through 1.10.0) allows a malicious or compromised HTTP/1 origin to desynchronize an RFC-9112-strict intermediary from Mint on a shared, pooled connection, poisoning the response queue so that later requests reusing that socket receive another request's or attacker-chosen response content. Mint's chunk-size parser accepts trailing junk after the hex size (for example '5ZZZZZ', '5 9', or '0ZZZZ') while strict proxies reject it, so the two disagree on chunk boundaries and on where the message ends. Exploitation is unauthenticated (PR:N) but conditional and non-trivial: it requires a pooled connection to an attacker-influenced origin plus a strict intermediary in the path; impact is limited to confidentiality and integrity of responses on the poisoned connection (VC:L/VI:L), with no availability or code-execution effect, and no public exploit code has been identified at time of analysis. Note that upstream tag metadata for this CVE includes 'RCE'; that label is not supported by the assessed vector or impact and should not be used for prioritization.
CPU exhaustion via crafted chunked HTTP responses affects the Elixir Mint HTTP client library (versions 1.9.3 through before 1.10.0). The chunk-size hex parser in `lib/mint/http1/parse.ex` accumulates digits into an arbitrary-precision integer using `acc * 16 + digit` with no upper bound on digit count, producing O(N²) cost per parse pass; compounded by a re-parse-from-start design on each socket message, a server that trickles digits forces the client to pay this cost repeatedly. Benchmark data in the advisory confirms ~512,000 hex digits produces over ten seconds of CPU in a single pass, and an intermediary inspecting only headers sees a normal 200 response. No public exploit identified at time of analysis; patch is available in version 1.10.0.
Response-queue poisoning in the elixir-mint Mint HTTP/1.1 client library (versions 0.1.0 through before 1.9.3) allows a malicious or attacker-influenced HTTP/1 origin server to desynchronize a strict RFC-compliant intermediary from the Mint client on shared keep-alive pooled connections. The root cause is `Mint.HTTP1.decode_body/5` using Elixir's `Integer.parse/2` for chunked transfer-encoding chunk-size parsing, which accepts RFC-forbidden leading `+` or `-` sign prefixes, causing both parties to disagree on where one HTTP response ends and the next begins. No public exploit has been identified at time of analysis, but a vendor-released patch is available in Mint 1.9.3.
Memory exhaustion in elixir-mint's HTTP/2 client library (mint) allows a malicious or attacker-controlled HTTP/2 server to crash any BEAM application using the library by streaming unbounded zero-length CONTINUATION frames that bypass the existing byte-size guard. Affected versions span mint 0.1.0 through 1.9.1; a vendor-released patch is confirmed in 1.9.2. No public exploit or CISA KEV listing exists at time of analysis, but the explicit SSRF and redirect attack vectors meaningfully increase realistic exposure for server-side Elixir applications that proxy user-supplied URLs.
HTTP response smuggling in the Elixir Mint HTTP client library (versions 0.1.0 through before 1.9.0) allows attacker-controlled upstream servers to desynchronize response framing on shared connections by exploiting a non-RFC-compliant Content-Length parser. Mint's parser accepts sign-prefixed integers such as '+0' or '+123' that RFC 7230 forbids, creating a disagreement with RFC-strict fronting proxies about where one HTTP response body ends and the next begins. When Mint reuses connections via keep-alive, pipelining, or pooling across trust boundaries, this parser mismatch can be weaponized to leak bytes from one requester's response into another's stream. No public exploit code has been identified at time of analysis, and no KEV listing exists; a vendor patch (v1.9.0) is available.
CRLF injection in the elixir-mint Mint HTTP/1.1 client library (versions 0.1.0 through 1.8.x) enables HTTP Request Splitting and HTTP Request Smuggling on shared TCP connections when applications forward attacker-controlled values as the HTTP method or target to Mint.HTTP.request/5. The target-based vector was partially closed in Mint 1.7.0 via validate_request_target/2, but the method field was left unvalidated in all versions prior to 1.9.0, meaning method-based injection remains exploitable under the default Mint configuration. No public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog; the complete fix shipping method-character validation is available in Mint 1.9.0.
Memory exhaustion denial-of-service in Elixir Mint affects versions 1.1.0 through 1.10.x and allows a malicious or compromised HTTP/2 server to force a client application to allocate roughly 1 GB per response by abusing HPACK indexed header fields and cookie handling, potentially exhausting the BEAM VM. The vulnerability requires the application to initiate an outbound HTTP/2 connection to an attacker-influenced endpoint (reverse-trust), and no public exploit code or confirmed active exploitation is identified at time of analysis. Downstream clients such as Finch and Req that use Mint are also affected when making outbound HTTP/2 requests to untrusted servers.
Unbounded memory accumulation in the elixir-mint Mint HTTP client library (versions 0.1.0 through <1.10.0) enables a remote HTTP server to exhaust client-side memory and crash the entire BEAM VM node. Two HTTP/1 parser states - the status-line decoder and the chunk-extension-line decoder - append successive socket data into `conn.buffer` with no size cap because the existing `:max_header_list_size` guard was wired only to header and trailer parsing, not to these two states. A malicious or attacker-redirected server that withholds CRLF terminators can grow the buffer indefinitely until the OS OOM-killer terminates the node, collaterally killing all other processes sharing it. No public exploit has been identified, but the technique requires only a straightforward streaming server.
Unbounded memory consumption in the Elixir Mint HTTP client (versions 0.1.0 through 1.9.1) lets a malicious or attacker-influenced HTTP server crash the entire BEAM application acting as the client. The HTTP/1 header and chunked-trailer parsers accumulate every incoming header line into a per-request buffer with no size or count cap, so a server that streams headers forever without sending the terminating blank line drives the client host to out-of-memory death. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor patch (1.9.2) and fix commit are available, and the EPSS/POC signals are unremarked in the source data.
Uncontrolled memory allocation in the Elixir Mint HTTP client (Mint.HTTP1 module, versions 0.5.0 through 1.9.0) lets a malicious or compromised HTTP server exhaust a client's memory and force an out-of-memory crash. When decoding a chunked response, Mint buffers every byte of the current chunk in an unbounded iolist and withholds it from the caller until the full declared chunk length arrives, so a server that advertises a huge chunk size (e.g. 0x7FFFFFFF ≈ 2 GiB) and then dribbles bytes slowly drives client memory arbitrarily high. This CWE-770 flaw is a denial-of-service only (VA:H, no confidentiality or integrity impact) with no public exploit identified at time of analysis and no CISA KEV listing.
Memory exhaustion in the Elixir Mint HTTP/2 client (versions 0.1.0 through 1.8.x) allows a malicious or compromised HTTP/2 server to crash the client's BEAM process via a CONTINUATION frame flood. The client's receive path buffers HEADERS and CONTINUATION fragments into an unbounded accumulator because SETTINGS_MAX_HEADER_LIST_SIZE defaulted to :infinity and was only enforced on outbound requests, so a single attacker-controlled endpoint can force unlimited iolist growth until the process dies. No public exploit identified at time of analysis, but a verified upstream patch and detailed advisory exist.
Memory exhaustion in elixir-mint Mint HTTP/2 client (versions 0.2.0 through 1.8.x) allows a malicious HTTP/2 server to crash the client process by flooding PUSH_PROMISE frames without follow-up HEADERS, since reserved stream entries bypass the max_concurrent_streams cap. CVSS 4.0 score is 8.2 with attack vector network and high availability impact, but no public exploit is identified at time of analysis and the bug requires the client to connect to a hostile server. Server push is accepted by default (enable_push=true), so any Mint-based HTTP client reaching an attacker-controlled origin is exposed.
HTTP/1 response smuggling in the Elixir Mint client (0.1.0 through 1.10.x) allows a malicious or attacker-influenced origin server to desynchronize Mint from an upstream intermediary on a pooled keep-alive connection, so that bytes following a crafted response are parsed as the answer to a subsequent request, poisoning that request's response. The root cause is that Mint's message_body/1 selects chunked framing whenever 'chunked' is the FIRST coding in a Transfer-Encoding header (e.g. 'Transfer-Encoding: chunked, gzip') instead of requiring it to be the final coding, and additionally keeps the connection open after an HTTP/1.0 response - final or 1xx - that carries Transfer-Encoding with 'Connection: keep-alive', both contrary to RFC 9112. Exploitation is a reverse-trust scenario: the attacker must control or inject server response framing and the client must reuse an HTTP/1 connection; HTTP/2 and non-pooled connections are unaffected, and no public exploit code or active exploitation was identified at time of analysis. The issue is fixed in Mint 1.11.0.
Memory exhaustion in the Elixir Mint HTTP/2 client (mint 0.1.0 through 1.10.x) lets a malicious or man-in-the-middle HTTP/2 server pin roughly 16 MiB of client buffer memory per open connection by declaring an oversized frame and withholding its final byte. The weakness is an unbounded resource allocation issue (CWE-770) in Mint.HTTP2.Frame.decode_next/2, which only checks a frame against the client's 16,384-byte max_frame_size after the entire declared payload has arrived, causing the connection buffer to keep accumulating bytes up to the 24-bit frame-length ceiling of 16,777,215 bytes. Impact is availability-only and low severity per the independent assessment: there is no amplification because the attacker must transmit every byte the client buffers, sustained denial of service requires many concurrently held connections plus matching attacker resources, and no public exploit identified at time of analysis, with no CISA KEV listing and no EPSS signal supplied. Attacker control of the server side is required (unauthenticated from the client's perspective, reflected as AT:P), and vendor patches are available in mint 1.11.0.
Chunked-response smuggling in the Elixir Mint HTTP client (0.1.0 through 1.10.0) allows a malicious or compromised HTTP/1 origin to desynchronize an RFC-9112-strict intermediary from Mint on a shared, pooled connection, poisoning the response queue so that later requests reusing that socket receive another request's or attacker-chosen response content. Mint's chunk-size parser accepts trailing junk after the hex size (for example '5ZZZZZ', '5 9', or '0ZZZZ') while strict proxies reject it, so the two disagree on chunk boundaries and on where the message ends. Exploitation is unauthenticated (PR:N) but conditional and non-trivial: it requires a pooled connection to an attacker-influenced origin plus a strict intermediary in the path; impact is limited to confidentiality and integrity of responses on the poisoned connection (VC:L/VI:L), with no availability or code-execution effect, and no public exploit code has been identified at time of analysis. Note that upstream tag metadata for this CVE includes 'RCE'; that label is not supported by the assessed vector or impact and should not be used for prioritization.
CPU exhaustion via crafted chunked HTTP responses affects the Elixir Mint HTTP client library (versions 1.9.3 through before 1.10.0). The chunk-size hex parser in `lib/mint/http1/parse.ex` accumulates digits into an arbitrary-precision integer using `acc * 16 + digit` with no upper bound on digit count, producing O(N²) cost per parse pass; compounded by a re-parse-from-start design on each socket message, a server that trickles digits forces the client to pay this cost repeatedly. Benchmark data in the advisory confirms ~512,000 hex digits produces over ten seconds of CPU in a single pass, and an intermediary inspecting only headers sees a normal 200 response. No public exploit identified at time of analysis; patch is available in version 1.10.0.
Response-queue poisoning in the elixir-mint Mint HTTP/1.1 client library (versions 0.1.0 through before 1.9.3) allows a malicious or attacker-influenced HTTP/1 origin server to desynchronize a strict RFC-compliant intermediary from the Mint client on shared keep-alive pooled connections. The root cause is `Mint.HTTP1.decode_body/5` using Elixir's `Integer.parse/2` for chunked transfer-encoding chunk-size parsing, which accepts RFC-forbidden leading `+` or `-` sign prefixes, causing both parties to disagree on where one HTTP response ends and the next begins. No public exploit has been identified at time of analysis, but a vendor-released patch is available in Mint 1.9.3.
Memory exhaustion in elixir-mint's HTTP/2 client library (mint) allows a malicious or attacker-controlled HTTP/2 server to crash any BEAM application using the library by streaming unbounded zero-length CONTINUATION frames that bypass the existing byte-size guard. Affected versions span mint 0.1.0 through 1.9.1; a vendor-released patch is confirmed in 1.9.2. No public exploit or CISA KEV listing exists at time of analysis, but the explicit SSRF and redirect attack vectors meaningfully increase realistic exposure for server-side Elixir applications that proxy user-supplied URLs.
HTTP response smuggling in the Elixir Mint HTTP client library (versions 0.1.0 through before 1.9.0) allows attacker-controlled upstream servers to desynchronize response framing on shared connections by exploiting a non-RFC-compliant Content-Length parser. Mint's parser accepts sign-prefixed integers such as '+0' or '+123' that RFC 7230 forbids, creating a disagreement with RFC-strict fronting proxies about where one HTTP response body ends and the next begins. When Mint reuses connections via keep-alive, pipelining, or pooling across trust boundaries, this parser mismatch can be weaponized to leak bytes from one requester's response into another's stream. No public exploit code has been identified at time of analysis, and no KEV listing exists; a vendor patch (v1.9.0) is available.
CRLF injection in the elixir-mint Mint HTTP/1.1 client library (versions 0.1.0 through 1.8.x) enables HTTP Request Splitting and HTTP Request Smuggling on shared TCP connections when applications forward attacker-controlled values as the HTTP method or target to Mint.HTTP.request/5. The target-based vector was partially closed in Mint 1.7.0 via validate_request_target/2, but the method field was left unvalidated in all versions prior to 1.9.0, meaning method-based injection remains exploitable under the default Mint configuration. No public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog; the complete fix shipping method-character validation is available in Mint 1.9.0.