CVE-2026-49754: Elixir Mint memory exhaustion via HTTP/2 CONTINUATION flood

Executive brief

Mint, a popular HTTP client for the Elixir programming language, is vulnerable to a denial-of-service attack when connecting to a malicious or compromised server. An attacker can send an endless stream of specific network data (HTTP/2 CONTINUATION frames) that forces the client to consume all available memory. This results in the application crashing, potentially disrupting services and business operations.

Technical details

The Mint HTTP/2 client implementation lacks a cap on the size or count of CONTINUATION header-block fragments stored in the 'conn.headers_being_processed' accumulator. When a HEADERS frame is received without the END_HEADERS flag, subsequent CONTINUATION frames are appended to this buffer without validation against max_header_list_size or other bounds. A remote, unauthenticated attacker controlling an HTTP/2 server can exploit this by streaming an infinite chain of CONTINUATION frames, leading to an Out-of-Memory (OOM) crash of the BEAM process. This vulnerability is a variation of the 'CONTINUATION flood' attack class. The issue is patched in version 1.9.0.

Affected products

• elixir-mint mint < 1.9.0

Timeline

• 2026-06-02: disclosed: NVD publication date
• 2026-07-09: advisory: GitHub Advisory published/updated
• 2026-07-09: patched: Patch version 1.9.0 released

References

• https://api.github.com/users/PJUllrich
• https://github.com/PJUllrich
• https://api.github.com/users/PJUllrich/gists%7B/gist_id%7D
• https://api.github.com/users/PJUllrich/repos
• https://avatars.githubusercontent.com/u/10426523?v=4
• https://api.github.com/users/PJUllrich/events%7B/privacy%7D