# CVE-2026-59246: Elixir Mint denial of service via HTTP/2 CONTINUATION flood

Source: https://junglewise.ai/threats/cve-2026-59246-elixir-mint-denial-of-service-via-http-2-continuation-flood  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-59246 · Severity: info · CVSS 6.3 · Published 2026-07-14

Mint is a popular HTTP client library for the Elixir programming language. A vulnerability in how it handles certain web traffic (HTTP/2) allows a malicious server to crash the application by forcing it to consume all available system memory. This can lead to a complete service outage for any Elixir-based application using this library to communicate with external servers.

## Quick answers

**Is CVE-2026-59246 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59246 being exploited in the wild.

**How severe is CVE-2026-59246?** Informational severity, with a CVSS score of 6.3, published 14 July 2026.

**Which products and versions are affected?** elixir-mint mint 0.1.0 to 1.9.1.

**Is there a fix for CVE-2026-59246?** A patch was published on 2026-07-14: Fixed in version 1.9.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59246 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-59246?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the Mint.HTTP2.handle_continuation/3 function within lib/mint/http2.ex. The library accumulates header-block fragments from HTTP/2 CONTINUATION frames into a nested data structure that is only cleared upon receipt of an END_HEADERS flag. While Mint implements a byte-size cap via Mint.HTTP2.assert_header_block_within_max_size/2, it fails to limit the number of frames. An attacker can send an infinite stream of zero-length CONTINUATION frames which bypass the byte-size check but still cause the memory-intensive nesting of the accumulator. This leads to memory exhaustion and termination of the BEAM node. The issue is fixed in version 1.9.2.

## Affected products

- elixir-mint mint 0.1.0 to 1.9.1

## Timeline

- 2026-07-14: disclosed
- 2026-07-14: advisory
- 2026-07-14: patched: Fixed in version 1.9.2

## References

- [https://repo.hex.pm/](https://repo.hex.pm/)
- [https://github.com/](https://github.com/)
- [https://cna.erlef.org/cves/CVE-2026-59246.html](https://cna.erlef.org/cves/CVE-2026-59246.html)
- [https://github.com/elixir-mint/mint/commit/5779de1666344b32aefc4354184ea07f902f73ce](https://github.com/elixir-mint/mint/commit/5779de1666344b32aefc4354184ea07f902f73ce)
- [https://github.com/elixir-mint/mint/security/advisories/GHSA-8pf6-g464-h6h9](https://github.com/elixir-mint/mint/security/advisories/GHSA-8pf6-g464-h6h9)