TI-2026-57047 Aliases CVE-2026-82729

Quadratic chunk-size parsing in Mint.HTTP1.Parse allows CPU-exhaustion DoS

MEDIUM 61CWE-407Published 2026-09-04 · Updated 2026-09-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-407.

Summary

Inefficient Algorithmic Complexity vulnerability in elixir-mint mint allows a remote HTTP server to exhaust CPU on the client host and cause a denial of service. parse_hex_prefix/2 in lib/mint/http1/parse.ex folds each hex digit of a chunked response's chunk-size field into an arbitrary-precision accumulator with acc * 16 + digit and imposes no limit on the digit count. Because the accumulator grows without bound, the multiplication is not constant time and one pass over N digits costs O(N squared). handle_data/2 prepends conn.buffer and re-parses from the start on every socket message, so a server that dribbles the digits out in small packets makes the client pay that cost repeatedly. A run of roughly 512,000 hex digits costs over ten seconds of CPU in a single pass, measured on stock defaults. The parser reaches this state after a valid status line and a complete, valid header section, so an intermediary inspecting only headers sees an ordinary 200 response. This issue affects mint: from 1.9.3 before 1.10.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00524 44th percentileScored 2026-11-07

Fix Fixed mint (elixir-mint): 1.10.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
elixir-mint	mint	1.9.3 to before 1.10.0	1.10.0	Patch available	CNA

mint Vendorelixir-mint Affected 1.9.3 to before 1.10.0 Fixed in 1.10.0 Patch available CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:elixir-mint:mint::::::::	—	—	—

cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Fix · CNA mint (elixir-mint) Fixed in 1.10.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-09-04
elixir-mint mint 1.10.0
2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM
Other records, highest priority first
- TI-2026-57046 Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoSPriority HIGH 69
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-82729

References

Patch 1

https://github.com/elixir-mint/mint/commit/bd2a4e7513594997c140cfef9fe0e968712fb588

Advisory 1

https://github.com/elixir-mint/mint/security/advisories/GHSA-7p8w-j234-7qc8

Other 2

TI-2026-41929 Unauthenticated denial-of-service via unbounded HPACK integer decoding in hpax CVSS 4.0HIGH 8.7
TI-2026-40963 mint buffers an entire chunked response chunk in memory in Mint.HTTP1.decode_body/5 CVSS 4.0HIGH 8.7
TI-2026-36665 HTTP/2 CONTINUATION flood in Mint client via unbounded header-block accumulation CVSS 4.0HIGH 8.2
TI-2026-36126 Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrency CVSS 4.0HIGH 8.2
TI-2026-57046 Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS CVSS 4.0HIGH 8.2
TI-2026-41932 Unbounded HTTP/1 response-header and chunked-trailer accumulation in Mint causes memory-exhaustion DoS CVSS 4.0HIGH 8.2

See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences