Junglewise Threat Intelligence

CVE-2026-59246: Elixir Mint denial of service via HTTP/2 CONTINUATION flood

CVE-2026-59246 · Severity: info · CVSS 6.3 · Published 2026-07-14

Technologies: Elixir-Mint Mint. Vendors: Elixir-Mint.

Executive brief

Mint is a popular HTTP client library for the Elixir programming language. A vulnerability in how it handles certain web traffic (HTTP/2) allows a malicious server to crash the application by forcing it to consume all available system memory. This can lead to a complete service outage for any Elixir-based application using this library to communicate with external servers.

Technical details

The vulnerability exists in the Mint.HTTP2.handle_continuation/3 function within lib/mint/http2.ex. The library accumulates header-block fragments from HTTP/2 CONTINUATION frames into a nested data structure that is only cleared upon receipt of an END_HEADERS flag. While Mint implements a byte-size cap via Mint.HTTP2.assert_header_block_within_max_size/2, it fails to limit the number of frames. An attacker can send an infinite stream of zero-length CONTINUATION frames which bypass the byte-size check but still cause the memory-intensive nesting of the accumulator. This leads to memory exhaustion and termination of the BEAM node. The issue is fixed in version 1.9.2.

Affected products

  • elixir-mint mint 0.1.0 to 1.9.1

Timeline

  • 2026-07-14: disclosed
  • 2026-07-14: advisory
  • 2026-07-14: patched: Fixed in version 1.9.2

References