Is CVE-2026-58229 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-58229 being exploited in the wild.

How severe is CVE-2026-58229?

Informational severity, with a CVSS score of 8.2, published 14 July 2026.

Which products and versions are affected?

Elixir-Mint Mint 0.1.0 to 1.9.1.

Is there a fix for CVE-2026-58229?

A patch was published on 2026-07-14: Fixed in version 1.9.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-58229 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-58229?

Check whether you run Elixir-Mint Mint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58229: Elixir Mint denial of service via unbounded HTTP header accumulation

CVE-2026-58229 · Severity: info · CVSS 8.2 · Published 2026-07-14

A vulnerability in the Mint HTTP client for Elixir allows a malicious web server to crash the application using it. By sending an endless stream of web headers without a closing signal, the server can force the client to consume all available system memory. This results in a denial-of-service (DoS) where the entire application is shut down by the operating system.

Technologies: Elixir-Mint Mint. Vendors: Elixir-Mint.

Quick answers

Is CVE-2026-58229 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-58229 being exploited in the wild.
How severe is CVE-2026-58229?: Informational severity, with a CVSS score of 8.2, published 14 July 2026.
Which products and versions are affected?: Elixir-Mint Mint 0.1.0 to 1.9.1.
Is there a fix for CVE-2026-58229?: A patch was published on 2026-07-14: Fixed in version 1.9.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58229 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-58229?: Check whether you run Elixir-Mint Mint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Mint.HTTP1.decode_headers/5 and Mint.HTTP1.decode_trailer_headers/4 functions in lib/mint/http1.ex fail to enforce limits on the number or size of HTTP response headers and chunked-trailer fields. These headers are accumulated into a per-request list (request.headers_buffer) that persists across TCP segments and is only cleared upon receiving a terminating blank line. Because the underlying Erlang :decode_packet parser is invoked without size constraints, a malicious server can stream header lines indefinitely. This causes the BEAM node's memory usage to grow until it is terminated by the OS out-of-memory (OOM) killer. The issue is fixed in version 1.9.2, which introduces a default 256 KiB limit via the :max_header_list_size option.

Affected products

elixir-mint mint 0.1.0 to 1.9.1

Timeline

2026-07-14: disclosed
2026-07-14: patched: Fixed in version 1.9.2
2026-07-14: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.