Is CVE-2026-59246 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59246 being exploited in the wild.

How severe is CVE-2026-59246?

Informational severity, with a CVSS score of 6.3, published 14 July 2026.

Which products and versions are affected?

elixir-mint mint 0.1.0 to 1.9.1.

Is there a fix for CVE-2026-59246?

A patch was published on 2026-07-14: Fixed in version 1.9.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59246 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-59246?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59246: Elixir Mint denial of service via HTTP/2 CONTINUATION flood

CVE-2026-59246 · Severity: info · CVSS 6.3 · Published 2026-07-14

Mint is a popular HTTP client library for the Elixir programming language. A vulnerability in how it handles certain web traffic (HTTP/2) allows a malicious server to crash the application by forcing it to consume all available system memory. This can lead to a complete service outage for any Elixir-based application using this library to communicate with external servers.

Quick answers

Is CVE-2026-59246 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59246 being exploited in the wild.
How severe is CVE-2026-59246?: Informational severity, with a CVSS score of 6.3, published 14 July 2026.
Which products and versions are affected?: elixir-mint mint 0.1.0 to 1.9.1.
Is there a fix for CVE-2026-59246?: A patch was published on 2026-07-14: Fixed in version 1.9.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59246 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-59246?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the Mint.HTTP2.handle_continuation/3 function within lib/mint/http2.ex. The library accumulates header-block fragments from HTTP/2 CONTINUATION frames into a nested data structure that is only cleared upon receipt of an END_HEADERS flag. While Mint implements a byte-size cap via Mint.HTTP2.assert_header_block_within_max_size/2, it fails to limit the number of frames. An attacker can send an infinite stream of zero-length CONTINUATION frames which bypass the byte-size check but still cause the memory-intensive nesting of the accumulator. This leads to memory exhaustion and termination of the BEAM node. The issue is fixed in version 1.9.2.

Affected products

elixir-mint mint 0.1.0 to 1.9.1

Timeline

2026-07-14: disclosed
2026-07-14: advisory
2026-07-14: patched: Fixed in version 1.9.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.