elixir-mint hpax up to 1.0.3 HPACK Integer Decoder lib/hpax/types.ex decode_remaining_integer denial of service

Summaryinfo

A vulnerability was found in elixir-mint hpax up to 1.0.3 and classified as problematic. This affects the function decode_remaining_integer of the file lib/hpax/types.ex of the component HPACK Integer Decoder. Executing a manipulation of the argument integer can lead to denial of service. This vulnerability is registered as CVE-2026-58226. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in elixir-mint hpax up to 1.0.3. It has been declared as problematic. This vulnerability affects the function decode_remaining_integer of the file lib/hpax/types.ex of the component HPACK Integer Decoder. The manipulation of the argument integer with an unknown input leads to a denial of service vulnerability. The CWE definition for the vulnerability is CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. As an impact it is known to affect availability. CVE summarizes:

Inefficient Algorithmic Complexity vulnerability in elixir-mint hpax allows unauthenticated denial-of-service via unbounded HPACK integer decoding. hpax decodes HPACK variable-length integers with no upper bound on the decoded value or the number of continuation octets. 'Elixir.HPAX.Types':decode_remaining_integer/3 accumulates the integer as int + (value <<< m), shifting by 7 more bits for each continuation octet and stopping only on a terminating octet or truncated input, never because the integer grew too large. Because BEAM integers are arbitrary precision, a run of N continuation octets builds an O(N)-bit bignum and re-adds into an ever-larger bignum on each step, so the total decoding cost is superlinear (about O(N^2)). An unauthenticated attacker who can send an HTTP/2 header block to a server using this decoder (reached through the 'Elixir.HPAX':decode/2 entry point) can supply a small header block that forces a large, attacker-controlled amount of CPU (and transient memory), a denial-of-service amplification. This issue affects hpax from 0.1.1 before 1.0.4.

The advisory is available at github.com. This vulnerability was named CVE-2026-58226 since 06/29/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1499 by the MITRE ATT&CK project.

Upgrading to version 1.0.4 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• elixir-mint

Name

• hpax

Version

• 1.0.0
• 1.0.1
• 1.0.2
• 1.0.3

Website

• Product: https://github.com/elixir-mint/hpax/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion