TI-2026-36665 Aliases CVE-2026-49754 GHSA-2p26-p43x-fhp8

HTTP/2 CONTINUATION flood in Mint client via unbounded header-block accumulation

HIGH 75CWE-770Published 2026-06-02 · Updated 2026-06-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint Mint allows attacker-controlled HTTP/2 servers to exhaust memory in a Mint client (HTTP/2 CONTINUATION flood). When Mint's HTTP/2 receive path observes a HEADERS frame without the END_HEADERS flag, the unparsed header-block fragment is parked in conn.headers_being_processed, and every subsequent CONTINUATION frame on that stream is appended to the accumulator. Nothing in the receive path caps the accumulator: there is no per-stream size limit, no CONTINUATION frame-count limit, and max_header_list_size is only enforced on outgoing requests, never on inbound header blocks (its default is :infinity). A malicious or compromised HTTP/2 server can stream an endless sequence of CONTINUATION frames (each up to the peer-advertised SETTINGS_MAX_FRAME_SIZE) and drive the client's iolist to arbitrary size, causing memory exhaustion and BEAM process death. A single connection to an attacker-controlled HTTP/2 endpoint is sufficient. This issue affects mint: from 0.1.0 before 1.9.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00384 32nd percentileScored 2026-11-07

Fix Fixed mint (elixir-mint): 1.9.0mint (Hex): 1.9.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
elixir-mint	mint	0.1.0 to before 1.9.0	1.9.0	Patch available	CNA
—	mint (Hex)	before 1.9.0	1.9.0	Patch available	GHSA-2p26-p43x-fhp8

mint Vendorelixir-mint Affected 0.1.0 to before 1.9.0 Fixed in 1.9.0 Patch available CNA
mint (Hex) Vendor— Affected before 1.9.0 Fixed in 1.9.0 Patch available GHSA-2p26-p43x-fhp8

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:elixir-mint:mint::::::::	—	—	—

cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Fix · CNA mint (elixir-mint) Fixed in 1.9.0
Fix · GHSA-2p26-p43x-fhp8 mint (Hex) Fixed in 1.9.0 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-06-02
elixir-mint mint 1.9.0
4 records Highest priority Priority HIGH 2 HIGH, 2 MEDIUM
Other records, highest priority first
- TI-2026-36126 Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrencyPriority HIGH 75
- TI-2026-36664 HTTP response smuggling in Mint HTTP/1 client via lenient Content-Length parsingPriority MEDIUM 61
- TI-2026-36125 CRLF injection in HTTP/1 request line via unvalidated method in MintPriority MEDIUM 44
Show all 4 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-49754
2026-10-03 Alias added: GHSA-2p26-p43x-fhp8

References

Patch 1

https://github.com/elixir-mint/mint/commit/b662d127d3028b5426c88d4c9cc7fe430491a10b

Advisory 2

Other 3

TI-2026-41929 Unauthenticated denial-of-service via unbounded HPACK integer decoding in hpax CVSS 4.0HIGH 8.7
TI-2026-40963 mint buffers an entire chunked response chunk in memory in Mint.HTTP1.decode_body/5 CVSS 4.0HIGH 8.7
TI-2026-36126 Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrency CVSS 4.0HIGH 8.2
TI-2026-57046 Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS CVSS 4.0HIGH 8.2
TI-2026-41932 Unbounded HTTP/1 response-header and chunked-trailer accumulation in Mint causes memory-exhaustion DoS CVSS 4.0HIGH 8.2
TI-2026-63369 Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding… CVSS 4.0MEDIUM 6.3

See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences