# CVE-2026-58229: Elixir Mint denial of service via unbounded HTTP header accumulation

Source: https://junglewise.ai/threats/cve-2026-58229-elixir-mint-denial-of-service-via-unbounded-http-header  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-58229 · Severity: info · CVSS 8.2 · Published 2026-07-14

A vulnerability in the Mint HTTP client for Elixir allows a malicious web server to crash the application using it. By sending an endless stream of web headers without a closing signal, the server can force the client to consume all available system memory. This results in a denial-of-service (DoS) where the entire application is shut down by the operating system.

Technologies: [Elixir-Mint Mint](https://junglewise.ai/threats/technologies/mint). Vendors: [Elixir-Mint](https://junglewise.ai/threats/vendors/elixir-mint).

## Quick answers

**Is CVE-2026-58229 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58229 being exploited in the wild.

**How severe is CVE-2026-58229?** Informational severity, with a CVSS score of 8.2, published 14 July 2026.

**Which products and versions are affected?** Elixir-Mint Mint 0.1.0 to 1.9.1.

**Is there a fix for CVE-2026-58229?** A patch was published on 2026-07-14: Fixed in version 1.9.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-58229 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-58229?** Check whether you run Elixir-Mint Mint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Mint.HTTP1.decode_headers/5 and Mint.HTTP1.decode_trailer_headers/4 functions in lib/mint/http1.ex fail to enforce limits on the number or size of HTTP response headers and chunked-trailer fields. These headers are accumulated into a per-request list (request.headers_buffer) that persists across TCP segments and is only cleared upon receiving a terminating blank line. Because the underlying Erlang :decode_packet parser is invoked without size constraints, a malicious server can stream header lines indefinitely. This causes the BEAM node's memory usage to grow until it is terminated by the OS out-of-memory (OOM) killer. The issue is fixed in version 1.9.2, which introduces a default 256 KiB limit via the :max_header_list_size option.

## Affected products

- elixir-mint mint 0.1.0 to 1.9.1

## Timeline

- 2026-07-14: disclosed
- 2026-07-14: patched: Fixed in version 1.9.2
- 2026-07-14: advisory

## References

- [https://repo.hex.pm/](https://repo.hex.pm/)
- [https://github.com/](https://github.com/)
- [https://cna.erlef.org/cves/CVE-2026-58229.html](https://cna.erlef.org/cves/CVE-2026-58229.html)
- [https://github.com/elixir-mint/mint/commit/566d702e6f29105f77522ca7aabb9f64f2f4e333](https://github.com/elixir-mint/mint/commit/566d702e6f29105f77522ca7aabb9f64f2f4e333)
- [https://github.com/elixir-mint/mint/security/advisories/GHSA-qrfr-wh4c-3qhw](https://github.com/elixir-mint/mint/security/advisories/GHSA-qrfr-wh4c-3qhw)

## Related threats

- [Mint HTTP request/response smuggling in transfer encoding parsing](https://junglewise.ai/threats/cve-2026-94194-inconsistent-interpretation-of-http-requests-http-request)
- [Elixir Mint HTTP/2 frame buffer exhaustion](https://junglewise.ai/threats/cve-2026-92103-allocation-of-resources-without-limits-or-throttling)
- [Mint HTTP/2 header list memory exhaustion denial of service](https://junglewise.ai/threats/cve-2026-91043-allocation-of-resources-without-limits-or-throttling)
- [Elixir Mint HTTP request smuggling in chunked transfer encoding](https://junglewise.ai/threats/cve-2026-82672-inconsistent-interpretation-of-http-requests-http-request)
- [elixir-mint HTTP/1 parser algorithmic complexity denial of service](https://junglewise.ai/threats/cve-2026-82729-elixir-mint-http-1-parser-algorithmic-complexity-denial-of)