CVE-2026-92103 in mint
Summary
by MITRE • 09/28/2026
Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to make the client hold up to about 16 MiB per connection in frames it should reject, consuming client memory.
Mint.HTTP2.Frame.decode_next/2 in lib/mint/http2/frame.ex compares a frame with the client's max_frame_size (16,384 bytes by default) only once the whole declared payload has arrived. Until then it returns :more, and Mint.HTTP2 keeps every received byte in the connection buffer. A server can declare a frame length of up to 16,777,215 bytes and withhold the last byte, keeping roughly 1,024 times the advertised limit buffered for as long as the connection stays open. The server has to send every byte the client buffers, so there is no amplification, and the buffer stops at the 24-bit frame length limit.
This issue affects mint: from 0.1.0 before 1.11.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/28/2026
The vulnerability identified in the elixir-mint library represents a critical resource exhaustion flaw within its HTTP/2 implementation, specifically affecting how connection buffers manage incoming data frames. This issue stems from an allocation of resources without limits or throttling, allowing a malicious server to force the client application to consume excessive memory by holding onto large amounts of buffered data that should logically be rejected immediately. The core technical failure lies in the logic governing frame validation within the Mint.HTTP2.Frame.decode_next function located in lib/mint/http2/frame.ex. Under normal operational procedures for HTTP/2, a client is expected to validate incoming frames against its configured maximum frame size limit before committing significant resources to processing them. However, in this vulnerable version of mint, which spans from 0.1.0 up to but not including 1.11.0, the validation mechanism is deferred until after the entire declared payload has been received and buffered by the connection layer.
The HTTP/2 protocol specification allows for frame lengths encoded as a twenty-four-bit unsigned integer, permitting values up to sixteen million seven hundred seventy-seven thousand two hundred fifteen bytes. A malicious server can exploit this capability by declaring a frame length near this maximum limit while withholding the final byte of transmission. Because mint buffers every received byte until it determines whether the full payload has arrived, and because the size check only occurs after that arrival is confirmed via the :more return state in earlier versions, the client retains approximately sixteen megabytes of data per connection in memory. This behavior effectively bypasses the intended max_frame_size limit, which defaults to sixteen thousand three hundred eighty-four bytes. Consequently, an attacker can maintain roughly one thousand and twenty-four times the advertised buffer limit for as long as they keep the TCP connection open, leading to significant memory pressure on the client side without any network amplification benefits since every byte must be transmitted by the server.
From a security impact perspective, this vulnerability facilitates Denial of Service attacks against applications utilizing mint for HTTP/2 communications. By opening multiple connections and initiating these oversized frame exchanges simultaneously, an attacker can exhaust the available memory resources of the host system running the Elixir application. This resource exhaustion can lead to process crashes, unresponsiveness, or complete service failure depending on the operating system's out-of-memory handling mechanisms. The attack vector is remote and requires only that the victim client connects to a malicious server capable of manipulating HTTP/2 frame headers in this specific manner. There are no authentication requirements for an attacker to exploit this flaw, making it particularly dangerous in public-facing services or APIs where clients may connect to untrusted endpoints.
This vulnerability aligns with CWE-770, which describes the allocation of resources without limits or throttling, and falls under MITRE ATT&CK technique T1498, specifically Network Denial of Service via resource exhaustion. The lack of immediate validation against configured constraints allows an external actor to manipulate internal state in a way that degrades system availability. To mitigate this risk, organizations must upgrade the elixir-mint library to version 1.11.0 or later where the frame size check is performed earlier in the processing pipeline, preventing the accumulation of excessive buffered data. Additionally, implementing network-level rate limiting and monitoring for unusual memory consumption patterns associated with HTTP/2 connections can provide secondary layers of defense against such resource exhaustion attempts until all affected systems are patched.