Executive brief
Mint is a popular HTTP client library for the Elixir programming language. A vulnerability in how it handles certain web traffic (HTTP/2) allows a malicious server to crash the application by forcing it to consume all available system memory. This can lead to a complete service outage for any Elixir-based application using this library to communicate with external servers.
Technical details
The vulnerability exists in the Mint.HTTP2.handle_continuation/3 function within lib/mint/http2.ex. The library accumulates header-block fragments from HTTP/2 CONTINUATION frames into a nested data structure that is only cleared upon receipt of an END_HEADERS flag. While Mint implements a byte-size cap via Mint.HTTP2.assert_header_block_within_max_size/2, it fails to limit the number of frames. An attacker can send an infinite stream of zero-length CONTINUATION frames which bypass the byte-size check but still cause the memory-intensive nesting of the accumulator. This leads to memory exhaustion and termination of the BEAM node. The issue is fixed in version 1.9.2.
Affected products
- elixir-mint mint 0.1.0 to 1.9.1
Timeline
- 2026-07-14: disclosed
- 2026-07-14: advisory
- 2026-07-14: patched: Fixed in version 1.9.2