{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/mint/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-49754"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Mint (\u003c 1.9.0)"],"_cs_severities":["medium"],"_cs_tags":["http/2","denial-of-service","vulnerability","elixir","mint"],"_cs_type":"advisory","_cs_vendors":["Elixir Mint"],"content_html":"\u003cp\u003eThe Elixir Mint HTTP/2 client is vulnerable to a denial-of-service attack (CVE-2026-49754) due to an unbounded accumulation of \u003ccode\u003eCONTINUATION\u003c/code\u003e header-block fragments. This vulnerability, disclosed by GHSA, allows a malicious or compromised HTTP/2 server to exhaust the client's memory. By streaming an endless sequence of \u003ccode\u003eCONTINUATION\u003c/code\u003e frames following an initial \u003ccode\u003eHEADERS\u003c/code\u003e frame that lacks the \u003ccode\u003eEND_HEADERS\u003c/code\u003e flag, an attacker can drive the client's process memory to arbitrary size. This flaw affects Mint versions prior to 1.9.0 and requires no specific client-side configuration, making the default Mint client susceptible. A single connection to an attacker-controlled HTTP/2 endpoint is sufficient to trigger memory exhaustion and ultimately crash the BEAM process, resulting in a remote, unauthenticated denial-of-service.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eA victim application using the Elixir Mint HTTP/2 client establishes an HTTP/2 connection to a server.\u003c/li\u003e\n\u003cli\u003eThe client sends an HTTP/2 \u003ccode\u003eHEADERS\u003c/code\u003e frame as part of a request to the server.\u003c/li\u003e\n\u003cli\u003eAn attacker-controlled or compromised HTTP/2 server receives the client's request.\u003c/li\u003e\n\u003cli\u003eThe malicious server responds to the client's request by sending a \u003ccode\u003eHEADERS\u003c/code\u003e frame on stream 1, deliberately setting \u003ccode\u003eflags = 0\u003c/code\u003e (omitting \u003ccode\u003eEND_HEADERS\u003c/code\u003e and \u003ccode\u003eEND_STREAM\u003c/code\u003e) and including an empty header-block fragment.\u003c/li\u003e\n\u003cli\u003eThe malicious server then continuously streams \u003ccode\u003eCONTINUATION\u003c/code\u003e frames on stream 1, each with \u003ccode\u003eflags = 0\u003c/code\u003e and a payload up to the peer-advertised \u003ccode\u003eSETTINGS_MAX_FRAME_SIZE\u003c/code\u003e, never setting \u003ccode\u003eEND_HEADERS\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe Mint client's HTTP/2 receive path, specifically the \u003ccode\u003e'Elixir.Mint.HTTP2':handle_continuation/3\u003c/code\u003e function, continuously appends these \u003ccode\u003eCONTINUATION\u003c/code\u003e fragments to the \u003ccode\u003econn.headers_being_processed\u003c/code\u003e buffer.\u003c/li\u003e\n\u003cli\u003eDue to the absence of per-stream size caps or \u003ccode\u003eCONTINUATION\u003c/code\u003e frame-count caps, the client's process memory grows linearly and uncontrollably with the incoming flood of \u003ccode\u003eCONTINUATION\u003c/code\u003e frames.\u003c/li\u003e\n\u003cli\u003eThe unbounded memory growth eventually leads to memory exhaustion and an Out-Of-Memory (OOM) error, causing the entire Elixir BEAM process running the Mint client to crash, resulting in a denial-of-service.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe successful exploitation of CVE-2026-49754 results in a remote, unauthenticated denial-of-service against any application utilizing the Elixir Mint HTTP/2 client to connect to an untrusted or attacker-influenced server. A single connection is sufficient for an attacker to drive the client's memory to an arbitrary size, leading to the crash of the underlying BEAM process. This can incapacitate critical services or applications relying on Mint for HTTP/2 communication, causing significant operational disruption and data unavailability. The default Mint configuration is vulnerable, requiring no specific client-side opt-in for exploitation. The vulnerability has been scored CVSS v4.0 8.2 (HIGH).\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the Elixir Mint library to version 1.9.0 or later to patch CVE-2026-49754.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, restrict Mint to HTTP/1 for connections to untrusted servers by passing \u003ccode\u003eprotocols: [:http1]\u003c/code\u003e to \u003ccode\u003e'Elixir.Mint.HTTP':connect/4\u003c/code\u003e to avoid the vulnerable HTTP/2 receive path, as outlined in the workarounds.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-09T23:21:55Z","date_published":"2026-07-09T23:21:55Z","id":"https://feed.craftedsignal.io/briefs/2026-07-mint-http2-continuation-flood/","summary":"A malicious or compromised HTTP/2 server can exploit CVE-2026-49754 in the Elixir Mint HTTP/2 client by sending an endless chain of CONTINUATION frames without an END_HEADERS flag, leading to unbounded memory accumulation, process exhaustion, and remote unauthenticated denial-of-service.","title":"Mint HTTP/2 Client Vulnerable to Unbounded CONTINUATION Frame Accumulation (CVE-2026-49754)","url":"https://feed.craftedsignal.io/briefs/2026-07-mint-http2-continuation-flood/"}],"language":"en","title":"CraftedSignal Threat Feed - Mint","version":"https://jsonfeed.org/version/1.1"}