TI-2026-36126 Aliases CVE-2026-48862 GHSA-g586-ccqf-7x4r

Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrency

HIGH 75CWE-770Published 2026-06-02 · Updated 2026-06-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint Mint allows attacker-controlled HTTP/2 servers to exhaust memory in a Mint client via PUSH_PROMISE flooding. In lib/mint/http2.ex, Mint.HTTP2.decode_push_promise_headers_and_add_response/5 inserts a :reserved_remote entry into conn.streams for every promised stream ID. The neighbouring Mint.HTTP2.assert_valid_promised_stream_id/2 only verifies that the promised ID is even and not already present; client_settings.max_concurrent_streams is not consulted at promise time. The concurrency cap is only checked when the response HEADERS for the promised stream arrive, so a server that emits PUSH_PROMISE frames and withholds the matching HEADERS never trips that check. HTTP/2 server push is accepted by default (client_settings.enable_push defaults to true). A single long-lived HTTP/2 connection to a hostile server lets that server pin one conn.streams entry per PUSH_PROMISE frame it sends, with no upper bound, until the client process runs out of memory. This issue affects mint: from 0.2.0 before 1.9.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00384 32nd percentileScored 2026-11-07

Fix Fixed mint (elixir-mint): 1.9.0mint (Hex): 1.9.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
elixir-mint	mint	0.2.0 to before 1.9.0	1.9.0	Patch available	CNA
—	mint (Hex)	0.2.0 to before 1.9.0	1.9.0	Patch available	GHSA-g586-ccqf-7x4r

mint Vendorelixir-mint Affected 0.2.0 to before 1.9.0 Fixed in 1.9.0 Patch available CNA
mint (Hex) Vendor— Affected 0.2.0 to before 1.9.0 Fixed in 1.9.0 Patch available GHSA-g586-ccqf-7x4r

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:elixir-mint:mint::::::::	—	—	—

cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Fix · CNA mint (elixir-mint) Fixed in 1.9.0
Fix · GHSA-g586-ccqf-7x4r mint (Hex) Fixed in 1.9.0 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-06-02
elixir-mint mint 1.9.0
4 records Highest priority Priority HIGH 2 HIGH, 2 MEDIUM
Other records, highest priority first
- TI-2026-36665 HTTP/2 CONTINUATION flood in Mint client via unbounded header-block accumulationPriority HIGH 75
- TI-2026-36664 HTTP response smuggling in Mint HTTP/1 client via lenient Content-Length parsingPriority MEDIUM 61
- TI-2026-36125 CRLF injection in HTTP/1 request line via unvalidated method in MintPriority MEDIUM 44
Show all 4 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-48862
2026-10-03 Alias added: GHSA-g586-ccqf-7x4r

References

Patch 1

https://github.com/elixir-mint/mint/commit/70b97b6a5209fb288b0e04d8e657dda26c59de67

Advisory 2

Other 3

TI-2026-41929 Unauthenticated denial-of-service via unbounded HPACK integer decoding in hpax CVSS 4.0HIGH 8.7
TI-2026-40963 mint buffers an entire chunked response chunk in memory in Mint.HTTP1.decode_body/5 CVSS 4.0HIGH 8.7
TI-2026-36665 HTTP/2 CONTINUATION flood in Mint client via unbounded header-block accumulation CVSS 4.0HIGH 8.2
TI-2026-57046 Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS CVSS 4.0HIGH 8.2
TI-2026-41932 Unbounded HTTP/1 response-header and chunked-trailer accumulation in Mint causes memory-exhaustion DoS CVSS 4.0HIGH 8.2
TI-2026-63369 Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding… CVSS 4.0MEDIUM 6.3

See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences