Executive brief
A vulnerability in the Mint HTTP client for Elixir allows a malicious web server to crash the application using it. By sending an endless stream of web headers without a closing signal, the server can force the client to consume all available system memory. This results in a denial-of-service (DoS) where the entire application is shut down by the operating system.
Technical details
The Mint.HTTP1.decode_headers/5 and Mint.HTTP1.decode_trailer_headers/4 functions in lib/mint/http1.ex fail to enforce limits on the number or size of HTTP response headers and chunked-trailer fields. These headers are accumulated into a per-request list (request.headers_buffer) that persists across TCP segments and is only cleared upon receiving a terminating blank line. Because the underlying Erlang :decode_packet parser is invoked without size constraints, a malicious server can stream header lines indefinitely. This causes the BEAM node's memory usage to grow until it is terminated by the OS out-of-memory (OOM) killer. The issue is fixed in version 1.9.2, which introduces a default 256 KiB limit via the :max_header_list_size option.
Affected products
- elixir-mint mint 0.1.0 to 1.9.1
Timeline
- 2026-07-14: disclosed
- 2026-07-14: patched: Fixed in version 1.9.2
- 2026-07-14: advisory