Weakness Type (CWE)

CWE-770 — CWE-770 Allocation of Resources Without Limits or Throttling

CAPEC

CVSS 4.0 Score

8.2

HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Vulnerability description

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint Mint allows attacker-controlled HTTP/2 servers to exhaust memory in a Mint client (HTTP/2 CONTINUATION flood).

When Mint's HTTP/2 receive path observes a HEADERS frame without the END_HEADERS flag, the unparsed header-block fragment is parked in conn.headers_being_processed, and every subsequent CONTINUATION frame on that stream is appended to the accumulator. Nothing in the receive path caps the accumulator: there is no per-stream size limit, no CONTINUATION frame-count limit, and max_header_list_size is only enforced on outgoing requests, never on inbound header blocks (its default is :infinity).

A malicious or compromised HTTP/2 server can stream an endless sequence of CONTINUATION frames (each up to the peer-advertised SETTINGS_MAX_FRAME_SIZE) and drive the client's iolist to arbitrary size, causing memory exhaustion and BEAM process death. A single connection to an attacker-controlled HTTP/2 endpoint is sufficient.

This issue affects mint: from 0.1.0 before 1.9.0.

Affected

pkg:hex/mint

Module Source File Routine
Mint.HTTP2 lib/mint/http2.ex Mint.HTTP2.handle_continuation/3
Mint.HTTP2.handle_headers/3
Status Type Version Changes / Fixed in
affected semver ⓘ 0.1.0 < 1.9.0

pkg:github/elixir-mint/mint

Module Source File Routine
Mint.HTTP2 lib/mint/http2.ex Mint.HTTP2.handle_continuation/3
Mint.HTTP2.handle_headers/3
Status Type Version Changes / Fixed in
affected git ⓘ 596ca43045 < b662d127d3

Workarounds

Restrict Mint to HTTP/1 on connections to untrusted servers by passing protocols: [:http1] to 'Elixir.Mint.HTTP':connect/4. This avoids the vulnerable HTTP/2 receive path entirely, at the cost of losing HTTP/2 for those connections.

References

Credits

  • Finder: Peter Ullrich
  • Remediation developer: Eric Meadows-Jönsson
  • Analyst: Jonatan Männchen / EEF

CVE record as JSON:  GET /cves/CVE-2026-49754.json
OSV record as JSON:  GET /osv/EEF-CVE-2026-49754.json