CVE-2026-82728 in mint
Summary
by MITRE • 09/04/2026
Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client host and cause a denial of service.
Two HTTP/1 response-parser states accumulate server data without any cap. In lib/mint/http1.ex, decode_status_line/4 stores the unconsumed data in conn.buffer when the status line is incomplete, and decode_body/5 does the same for an unterminated chunk-extension line. Both wait for a CRLF the server never has to send, and conn.buffer is prepended to every subsequent socket message. The :max_header_list_size budget is wired only into decode_headers/5 and decode_trailer_headers/4, so neither of these states is covered by it. A malicious server, or one reached through an attacker-controlled redirect or a fetched URL, streams bytes indefinitely until the BEAM node is killed by the operating system out-of-memory handler. The chunk-extension variant is reached after a valid status line and a complete, valid header section, so an intermediary inspecting only headers sees an ordinary 200 response.
This issue affects mint: from 0.1.0 before 1.10.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/05/2026
The vulnerability identified in the elixir-mint HTTP client library represents a critical allocation of resources without limits or throttling, specifically manifesting as an unbounded memory consumption flaw within the HTTP/1 response parsing logic. This issue allows a remote malicious server to exhaust the available memory on the host running the BEAM virtual machine, ultimately leading to a denial of service condition where the application process is terminated by the operating system's out-of-memory handler. The root cause lies in two specific states within the HTTP/1 parser implementation found in lib/mint/http1.ex: decode_status_line and decode_body. In these states, server-provided data is accumulated into the connection buffer without any upper bound or cap on size. Specifically, when a status line is incomplete, the unconsumed data is stored in conn.buffer while waiting for a carriage return-line feed sequence that may never arrive if the attacker controls the stream termination. Similarly, during body decoding, an unterminated chunk-extension line causes continuous accumulation of server data into the same buffer structure.
The operational impact of this flaw is severe because it bypasses existing security configurations designed to prevent similar attacks. The library implements a :max_header_list_size configuration parameter intended to limit resource usage; however, this budget is only applied within the decode_headers and decode_trailer_headers functions. It is entirely absent from the logic governing status line parsing and chunked transfer encoding body decoding. Consequently, an attacker can exploit these uncovered code paths to stream bytes indefinitely. The mechanism involves prepending conn.buffer content to every subsequent socket message received, which causes exponential or linear memory growth depending on implementation details of buffer concatenation in Elixir lists. This results in the BEAM node consuming increasing amounts of RAM until it is forcibly killed by the operating system, effectively taking down any service relying on this HTTP client for communication.
From a security classification perspective, this vulnerability aligns with CWE-770: Allocation of Resources Without Limits or Throttling and CWE-400: Uncontrolled Resource Consumption. It also maps to MITRE ATT&CK technique T1498: Network Denial of Service, specifically under the sub-category of resource exhaustion via unbounded input processing. The attack vector is particularly insidious because it can be triggered not only by a direct connection to a malicious server but also through an attacker-controlled redirect or when fetching URLs that lead to compromised endpoints. Furthermore, the chunk-extension variant of this exploit is reachable after a valid status line and complete header section have been processed. This means that network intermediaries such as firewalls or intrusion detection systems inspecting only HTTP headers may classify the traffic as benign, allowing the malicious payload to pass through undetected before triggering the memory exhaustion on the client side.
Mitigation strategies must focus on immediate patching and defensive coding practices within dependent applications. The primary remediation is to upgrade the elixir-mint library to version 1.10.0 or later, where these parsing states have been corrected to enforce resource limits consistent with header processing constraints. For environments unable to update immediately, developers should implement connection timeouts and strict response size limits at the application layer using wrapper modules that monitor buffer sizes before they are processed by mint internals. Additionally, configuring the BEAM runtime with appropriate memory allocation limits can provide a secondary safety net, although this is less effective than fixing the underlying parsing logic. It is crucial to validate all incoming HTTP responses for completeness and enforce strict length constraints on status lines and chunked body extensions to prevent unbounded accumulation of data in client-side buffers.