# CVE-2026-56810: Elixir Mint denial of service in Mint.HTTP1 chunked decoder

Source: https://junglewise.ai/threats/cve-2026-56810-elixir-mint-denial-of-service-in-mint-http1-chunked-decoder  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-06. Updated: 2026-07-06  
License: CC BY 4.0 with a link back

CVE-2026-56810 · Severity: info · CVSS 8.7 · Published 2026-07-06

Elixir Mint, a popular HTTP client library, contains a vulnerability that allows a malicious server to crash the application using it. By sending a specially crafted response that claims to be very large but never finishes, the server can force the client to consume all available system memory. This can lead to a denial-of-service (DoS) condition, affecting the availability of any service that uses Mint to fetch external data, follow redirects, or process webhooks.

Technologies: [Elixir-Mint Mint](https://junglewise.ai/threats/technologies/mint). Vendors: [Elixir-Mint](https://junglewise.ai/threats/vendors/elixir-mint).

## Quick answers

**Is CVE-2026-56810 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56810 being exploited in the wild.

**How severe is CVE-2026-56810?** Informational severity, with a CVSS score of 8.7, published 6 July 2026.

**Which products and versions are affected?** Elixir-Mint Mint 0.5.0 to 1.9.0.

**Is there a fix for CVE-2026-56810?** A patch was published on 2026-07-06. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56810 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-56810?** Check whether you run Elixir-Mint Mint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A resource exhaustion vulnerability exists in the Mint.HTTP1 module of the Elixir Mint library. The root cause is located in the 'decode_body/5' and 'add_body_to_buffer/2' routines, where the decoder parses chunk sizes from a server without an upper bound and buffers all partial fragments in an unbounded iolist until the full declared chunk length is received. An unauthenticated remote attacker can exploit this by serving a response with a massive chunk size (e.g., 2 GiB) and never completing the chunk, bypassing streaming protections and driving the client's memory usage until an out-of-memory (OOM) condition occurs. This affects versions 0.5.0 through 1.9.0 and is fixed in version 1.9.1.

## Affected products

- elixir-mint mint 0.5.0 to 1.9.0

## Timeline

- 2026-07-06: advisory
- 2026-07-06: disclosed
- 2026-07-06: patched

## References

- [https://repo.hex.pm/](https://repo.hex.pm/)
- [https://github.com/](https://github.com/)
- [https://cna.erlef.org/cves/CVE-2026-56810.html](https://cna.erlef.org/cves/CVE-2026-56810.html)
- [https://github.com/elixir-mint/mint/commit/193ce714907d16e8adc4ab3c40e4f0c2f045b2a6](https://github.com/elixir-mint/mint/commit/193ce714907d16e8adc4ab3c40e4f0c2f045b2a6)
- [https://github.com/elixir-mint/mint/security/advisories/GHSA-c59h-fq4p-r36r](https://github.com/elixir-mint/mint/security/advisories/GHSA-c59h-fq4p-r36r)

## Related threats

- [Mint HTTP request/response smuggling in transfer encoding parsing](https://junglewise.ai/threats/cve-2026-94194-inconsistent-interpretation-of-http-requests-http-request)
- [Elixir Mint HTTP/2 frame buffer exhaustion](https://junglewise.ai/threats/cve-2026-92103-allocation-of-resources-without-limits-or-throttling)
- [Mint HTTP/2 header list memory exhaustion denial of service](https://junglewise.ai/threats/cve-2026-91043-allocation-of-resources-without-limits-or-throttling)
- [Elixir Mint HTTP request smuggling in chunked transfer encoding](https://junglewise.ai/threats/cve-2026-82672-inconsistent-interpretation-of-http-requests-http-request)
- [elixir-mint HTTP/1 parser algorithmic complexity denial of service](https://junglewise.ai/threats/cve-2026-82729-elixir-mint-http-1-parser-algorithmic-complexity-denial-of)