# CVE-2026-49754: Elixir Mint memory exhaustion via HTTP/2 CONTINUATION flood

Source: https://junglewise.ai/threats/cve-2026-49754-elixir-mint-memory-exhaustion-via-http-2-continuation-flood  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-02. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-49754 · Severity: high · CVSS 8.2 · Published 2026-06-02

Mint, a popular HTTP client for the Elixir programming language, is vulnerable to a denial-of-service attack when connecting to a malicious or compromised server. An attacker can send an endless stream of specific network data (HTTP/2 CONTINUATION frames) that forces the client to consume all available memory. This results in the application crashing, potentially disrupting services and business operations.

Technologies: [Elixir-Mint Mint](https://junglewise.ai/threats/technologies/mint). Vendors: [Elixir-Mint](https://junglewise.ai/threats/vendors/elixir-mint).

## Quick answers

**Is CVE-2026-49754 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49754 being exploited in the wild.

**How severe is CVE-2026-49754?** High severity, with a CVSS score of 8.2, published 2 June 2026.

**Which products and versions are affected?** Elixir-Mint Mint < 1.9.0, 0.1.0 to < 1.9.0.

**Is there a fix for CVE-2026-49754?** A patch was published on 2026-07-09: Patch version 1.9.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49754 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-49754?** Check whether you run Elixir-Mint Mint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Mint HTTP/2 client implementation lacks a cap on the size or count of CONTINUATION header-block fragments stored in the 'conn.headers_being_processed' accumulator. When a HEADERS frame is received without the END_HEADERS flag, subsequent CONTINUATION frames are appended to this buffer without validation against max_header_list_size or other bounds. A remote, unauthenticated attacker controlling an HTTP/2 server can exploit this by streaming an infinite chain of CONTINUATION frames, leading to an Out-of-Memory (OOM) crash of the BEAM process. This vulnerability is a variation of the 'CONTINUATION flood' attack class. The issue is patched in version 1.9.0.

## Affected products

- elixir-mint mint < 1.9.0

## Identifiers

- CVE-2026-49754
- GHSA-2p26-p43x-fhp8

## Timeline

- 2026-06-02: disclosed: NVD publication date
- 2026-07-09: advisory: GitHub Advisory published/updated
- 2026-07-09: patched: Patch version 1.9.0 released

## References

- [https://api.github.com/users/PJUllrich](https://api.github.com/users/PJUllrich)
- [https://github.com/PJUllrich](https://github.com/PJUllrich)
- [https://api.github.com/users/PJUllrich/gists%7B/gist_id%7D](https://api.github.com/users/PJUllrich/gists%7B/gist_id%7D)
- [https://api.github.com/users/PJUllrich/repos](https://api.github.com/users/PJUllrich/repos)
- [https://avatars.githubusercontent.com/u/10426523?v=4](https://avatars.githubusercontent.com/u/10426523?v=4)
- [https://api.github.com/users/PJUllrich/events%7B/privacy%7D](https://api.github.com/users/PJUllrich/events%7B/privacy%7D)

## Related threats

- [Mint HTTP request/response smuggling in transfer encoding parsing](https://junglewise.ai/threats/cve-2026-94194-inconsistent-interpretation-of-http-requests-http-request)
- [Elixir Mint HTTP/2 frame buffer exhaustion](https://junglewise.ai/threats/cve-2026-92103-allocation-of-resources-without-limits-or-throttling)
- [Mint HTTP/2 header list memory exhaustion denial of service](https://junglewise.ai/threats/cve-2026-91043-allocation-of-resources-without-limits-or-throttling)
- [Elixir Mint HTTP request smuggling in chunked transfer encoding](https://junglewise.ai/threats/cve-2026-82672-inconsistent-interpretation-of-http-requests-http-request)
- [elixir-mint HTTP/1 parser algorithmic complexity denial of service](https://junglewise.ai/threats/cve-2026-82729-elixir-mint-http-1-parser-algorithmic-complexity-denial-of)