Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.3
CVE-2026-58229: Mint HTTP Client Memory Exhaustion from Unbounded Headers
CVE-2026-58229 · published 3 months ago
Summary
A malicious server can exhaust the memory of an application using Mint as an HTTP client, causing it to crash. This is a concern because it can lead to downtime and lost productivity. To mitigate this issue, update to Mint version 1.9.2 or later.
What to do
- Update ericmj mint to version 1.9.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Hex | ericmj | mint |
>= 0.1.0, < 1.9.2 Fix: upgrade to 1.9.2
|
| – | elixir-mint | mint |
< 1.9.2 < 566d702e6f29105f77522ca7aabb9f64f2f4e333 |
Original advisory text
Unbounded HTTP/1 response-header and chunked-trailer accumulation in Mint causes memory-exhaustion DoS
Allocation of resources without limits vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client host and cause a denial of service.
The Mint.HTTP1.decode_headers/5 and Mint.HTTP1.decode_trailer_headers/4 functions in lib/mint/http1.ex accumulate every parsed response header and chunked-trailer field into a per-request list that persists across incoming TCP segments as request.headers_buffer, and only clear it when the terminating blank line is received. The section has no cap on the number of headers or on total bytes, and the underlying :erlang.decode_packet(:httph_bin, binary, []) parser is invoked with an empty option list so its per-line and per-packet size limits also default to unlimited.
A malicious HTTP server (reachable directly, via an attacker-controlled redirect, via SSRF, or via a man-in-the-middle) can stream complete header lines (or, after a chunked body, complete trailer lines) indefinitely without ever emitting the terminating blank line. The connection state grows without bound until the BEAM node is killed by the operating system's out-of-memory handler, taking down the entire application that uses Mint as an HTTP client.
This issue affects mint: from 0.1.0 before 1.9.2.
The Mint.HTTP1.decode_headers/5 and Mint.HTTP1.decode_trailer_headers/4 functions in lib/mint/http1.ex accumulate every parsed response header and chunked-trailer field into a per-request list that persists across incoming TCP segments as request.headers_buffer, and only clear it when the terminating blank line is received. The section has no cap on the number of headers or on total bytes, and the underlying :erlang.decode_packet(:httph_bin, binary, []) parser is invoked with an empty option list so its per-line and per-packet size limits also default to unlimited.
A malicious HTTP server (reachable directly, via an attacker-controlled redirect, via SSRF, or via a man-in-the-middle) can stream complete header lines (or, after a chunked body, complete trailer lines) indefinitely without ever emitting the terminating blank line. The connection state grows without bound until the BEAM node is killed by the operating system's out-of-memory handler, taking down the entire application that uses Mint as an HTTP client.
This issue affects mint: from 0.1.0 before 1.9.2.
References
- https://github.com/elixir-mint/mint/commit/566d702e6f29105f77522ca7aabb9f64f2f4e... Patch
- https://hex.pm/packages/mint Product
- https://github.com URL
- https://repo.hex.pm URL
- https://cna.erlef.org/cves/CVE-2026-58229.html URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58229... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-58229 Vendor Advisory
- https://github.com/elixir-mint/mint Product
- https://osv.dev/vulnerability/EEF-CVE-2026-58229 URL
- https://github.com/elixir-mint/mint/security/advisories/GHSA-qrfr-wh4c-3qhw Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
8.3
High
Type
CWE-770Allocation of Resources Without Limits
Timeline
Published14 Jul 2026
Updated4 Nov 2026
First seen14 Jul 2026
Sources
CVE-2026-58229 · NVD
EEF-CVE-2026-58229 · OSV
GHSA-qrfr-wh4c-3qhw · GHSA
CVE-2026-58229 · MITRE
CVE-2026-58229 · OSV
Track software like this
Free during beta