CVE-2026-49754: Elixir Mint memory exhaustion via HTTP/2 CONTINUATION flood

CVE-2026-49754 · Severity: high · CVSS 8.2 · Published 2026-06-02

Mint, a popular HTTP client for the Elixir programming language, is vulnerable to a denial-of-service attack when connecting to a malicious or compromised server. An attacker can send an endless stream of specific network data (HTTP/2 CONTINUATION frames) that forces the client to consume all available memory. This results in the application crashing, potentially disrupting services and business operations.

Technologies: Elixir-Mint Mint. Vendors: Elixir-Mint.

Quick answers

Is CVE-2026-49754 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-49754 being exploited in the wild.
How severe is CVE-2026-49754?
High severity, with a CVSS score of 8.2, published 2 June 2026.
Which products and versions are affected?
Elixir-Mint Mint < 1.9.0, 0.1.0 to < 1.9.0.
Is there a fix for CVE-2026-49754?
A patch was published on 2026-07-09: Patch version 1.9.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49754 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-49754?
Check whether you run Elixir-Mint Mint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Mint HTTP/2 client implementation lacks a cap on the size or count of CONTINUATION header-block fragments stored in the 'conn.headers_being_processed' accumulator. When a HEADERS frame is received without the END_HEADERS flag, subsequent CONTINUATION frames are appended to this buffer without validation against max_header_list_size or other bounds. A remote, unauthenticated attacker controlling an HTTP/2 server can exploit this by streaming an infinite chain of CONTINUATION frames, leading to an Out-of-Memory (OOM) crash of the BEAM process. This vulnerability is a variation of the 'CONTINUATION flood' attack class. The issue is patched in version 1.9.0.

Affected products

  • elixir-mint mint < 1.9.0

Identifiers

  • CVE-2026-49754
  • GHSA-2p26-p43x-fhp8

Timeline

  • 2026-06-02: disclosed: NVD publication date
  • 2026-07-09: advisory: GitHub Advisory published/updated
  • 2026-07-09: patched: Patch version 1.9.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.