Elixir Mint - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/elixir-mint/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 09 Jul 2026 23:21:55 +0000Mint HTTP/2 Client Vulnerable to Unbounded CONTINUATION Frame Accumulation (CVE-2026-49754)https://feed.craftedsignal.io/briefs/2026-07-mint-http2-continuation-flood/Thu, 09 Jul 2026 23:21:55 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-mint-http2-continuation-flood/A malicious or compromised HTTP/2 server can exploit CVE-2026-49754 in the Elixir Mint HTTP/2 client by sending an endless chain of CONTINUATION frames without an END_HEADERS flag, leading to unbounded memory accumulation, process exhaustion, and remote unauthenticated denial-of-service.The Elixir Mint HTTP/2 client is vulnerable to a denial-of-service attack (CVE-2026-49754) due to an unbounded accumulation of CONTINUATION header-block fragments. This vulnerability, disclosed by GHSA, allows a malicious or compromised HTTP/2 server to exhaust the client's memory. By streaming an endless sequence of CONTINUATION frames following an initial HEADERS frame that lacks the END_HEADERS flag, an attacker can drive the client's process memory to arbitrary size. This flaw affects Mint versions prior to 1.9.0 and requires no specific client-side configuration, making the default Mint client susceptible. A single connection to an attacker-controlled HTTP/2 endpoint is sufficient to trigger memory exhaustion and ultimately crash the BEAM process, resulting in a remote, unauthenticated denial-of-service.

Attack Chain

  1. A victim application using the Elixir Mint HTTP/2 client establishes an HTTP/2 connection to a server.
  2. The client sends an HTTP/2 HEADERS frame as part of a request to the server.
  3. An attacker-controlled or compromised HTTP/2 server receives the client's request.
  4. The malicious server responds to the client's request by sending a HEADERS frame on stream 1, deliberately setting flags = 0 (omitting END_HEADERS and END_STREAM) and including an empty header-block fragment.
  5. The malicious server then continuously streams CONTINUATION frames on stream 1, each with flags = 0 and a payload up to the peer-advertised SETTINGS_MAX_FRAME_SIZE, never setting END_HEADERS.
  6. The Mint client's HTTP/2 receive path, specifically the 'Elixir.Mint.HTTP2':handle_continuation/3 function, continuously appends these CONTINUATION fragments to the conn.headers_being_processed buffer.
  7. Due to the absence of per-stream size caps or CONTINUATION frame-count caps, the client's process memory grows linearly and uncontrollably with the incoming flood of CONTINUATION frames.
  8. The unbounded memory growth eventually leads to memory exhaustion and an Out-Of-Memory (OOM) error, causing the entire Elixir BEAM process running the Mint client to crash, resulting in a denial-of-service.

Impact

The successful exploitation of CVE-2026-49754 results in a remote, unauthenticated denial-of-service against any application utilizing the Elixir Mint HTTP/2 client to connect to an untrusted or attacker-influenced server. A single connection is sufficient for an attacker to drive the client's memory to an arbitrary size, leading to the crash of the underlying BEAM process. This can incapacitate critical services or applications relying on Mint for HTTP/2 communication, causing significant operational disruption and data unavailability. The default Mint configuration is vulnerable, requiring no specific client-side opt-in for exploitation. The vulnerability has been scored CVSS v4.0 8.2 (HIGH).

Recommendation

  • Upgrade the Elixir Mint library to version 1.9.0 or later to patch CVE-2026-49754.
  • If immediate patching is not possible, restrict Mint to HTTP/1 for connections to untrusted servers by passing protocols: [:http1] to 'Elixir.Mint.HTTP':connect/4 to avoid the vulnerable HTTP/2 receive path, as outlined in the workarounds.
]]>mediumadvisoryhttp/2denial-of-servicevulnerabilityelixirmintMint HTTP/2 Client Unbounded Stream Map Growth Denial-of-Service (CVE-2026-48862)https://feed.craftedsignal.io/briefs/2026-07-mint-dos/Thu, 09 Jul 2026 23:21:09 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-mint-dos/A malicious or compromised HTTP/2 server can exploit CVE-2026-48862 in Mint HTTP/2 clients by flooding them with PUSH_PROMISE frames and withholding corresponding HEADERS, leading to unbounded memory consumption and denial-of-service.Elixir-Mint HTTP/2 client versions 0.2.0 through 1.8.x are vulnerable to a remote, unauthenticated denial-of-service attack, identified as CVE-2026-48862. A hostile or compromised HTTP/2 server can leverage this vulnerability by sending an excessive number of PUSH_PROMISE frames without following up with the matching HEADERS. Mint's client, by default, accepts PUSH_PROMISE frames and inserts entries into an internal connection stream map without properly enforcing the max_concurrent_streams limit, causing the map to grow indefinitely. This unbounded growth leads to linear memory consumption within the client process, eventually resulting in an out-of-memory (OOM) crash and denying service. This vulnerability affects any application using Mint as an HTTP/2 client, especially those connecting to untrusted or attacker-influenced servers, such as web backends, webhook delivery systems, and proxy components.

Attack Chain

  1. A malicious or compromised HTTP/2 server establishes a long-lived HTTP/2 connection with a vulnerable Mint client.
  2. The Mint client sends its initial request HEADERS for a specific odd stream ID.
  3. The malicious server captures the client's request stream ID.
  4. The malicious server then sends a rapid flood of PUSH_PROMISE frames, each associated with the client's request stream ID.
  5. Each PUSH_PROMISE frame specifies a new, unique even stream ID and carries a minimal HPACK-encoded header block.
  6. The Mint client processes each PUSH_PROMISE frame, adding a :reserved_remote entry into its conn.streams map for every promised stream ID without consulting max_concurrent_streams.
  7. The malicious server intentionally withholds the corresponding response HEADERS for all the promised stream IDs.
  8. As the conn.streams map grows linearly with each unfulfilled PUSH_PROMISE frame, the Mint client's process consumes an increasing amount of memory until it crashes due to an Out-Of-Memory (OOM) error.

Impact

Successful exploitation of CVE-2026-48862 results in a remote, unauthenticated denial-of-service against any process utilizing Mint as an HTTP/2 client when connecting to an untrusted or attacker-controlled server. Since HTTP/2 server push is enabled by default in Mint, no specific application opt-in is required for the vulnerability to be exploitable. Affected systems include outbound HTTP/2 clients in web backends, webhook delivery services, data scrapers, federated components, and proxy services that interact with external HTTP/2 origins. An attacker can crash the client process, rendering the service unavailable and potentially requiring manual intervention to restore.

Recommendation

  • Upgrade all affected Mint HTTP/2 clients to version 1.9.0 or newer immediately to mitigate CVE-2026-48862.
  • For systems that cannot be immediately upgraded, disable HTTP/2 server push on connections to untrusted servers by explicitly passing client_settings: [enable_push: false] to the 'Elixir.Mint.HTTP':connect/4 function as a workaround for CVE-2026-48862.
]]>mediumadvisorydenial-of-servicehttp/2elixirclient-sidevulnerability