TI-2026-57046 Aliases CVE-2026-82728

Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS

HIGH 69CWE-770Published 2026-09-04 · Updated 2026-09-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-770.

Summary

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client host and cause a denial of service. Two HTTP/1 response-parser states accumulate server data without any cap. In lib/mint/http1.ex, decode_status_line/4 stores the unconsumed data in conn.buffer when the status line is incomplete, and decode_body/5 does the same for an unterminated chunk-extension line. Both wait for a CRLF the server never has to send, and conn.buffer is prepended to every subsequent socket message. The :max_header_list_size budget is wired only into decode_headers/5 and decode_trailer_headers/4, so neither of these states is covered by it. A malicious server, or one reached through an attacker-controlled redirect or a fetched URL, streams bytes indefinitely until the BEAM node is killed by the operating system out-of-memory handler. The chunk-extension variant is reached after a valid status line and a complete, valid header section, so an intermediary inspecting only headers sees an ordinary 200 response. This issue affects mint: from 0.1.0 before 1.10.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00524 44th percentileScored 2026-11-07

Fix Fixed mint (elixir-mint): 1.10.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
elixir-mint	mint	0.1.0 to before 1.10.0	1.10.0	Patch available	CNA

mint Vendorelixir-mint Affected 0.1.0 to before 1.10.0 Fixed in 1.10.0 Patch available CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:elixir-mint:mint::::::::	—	—	—

cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Fix · CNA mint (elixir-mint) Fixed in 1.10.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-09-04
elixir-mint mint 1.10.0
2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM
Other records, highest priority first
- TI-2026-57047 Quadratic chunk-size parsing in Mint.HTTP1.Parse allows CPU-exhaustion DoSPriority MEDIUM 61
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-82728

References

Patch 1

https://github.com/elixir-mint/mint/commit/19be5558b6a317e271c78666498dd78b151e490a

Advisory 1

https://github.com/elixir-mint/mint/security/advisories/GHSA-g83f-2j6r-q6m4

Other 2

TI-2026-41929 Unauthenticated denial-of-service via unbounded HPACK integer decoding in hpax CVSS 4.0HIGH 8.7
TI-2026-40963 mint buffers an entire chunked response chunk in memory in Mint.HTTP1.decode_body/5 CVSS 4.0HIGH 8.7
TI-2026-36665 HTTP/2 CONTINUATION flood in Mint client via unbounded header-block accumulation CVSS 4.0HIGH 8.2
TI-2026-36126 Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrency CVSS 4.0HIGH 8.2
TI-2026-41932 Unbounded HTTP/1 response-header and chunked-trailer accumulation in Mint causes memory-exhaustion DoS CVSS 4.0HIGH 8.2
TI-2026-63369 Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding… CVSS 4.0MEDIUM 6.3

See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences