Executive brief
mint is an HTTP client library for Elixir used by applications to communicate with web services. A malicious HTTP server can send carefully crafted responses that cause the client's CPU to spike and become unresponsive, disrupting application availability and degrading user experience.
Technical details
The vulnerability is an algorithmic complexity issue in the parse_hex_prefix/2 function within lib/mint/http1/parse.ex. The parser processes hex digits in chunked HTTP response chunk-size fields using unbounded-precision arithmetic (acc * 16 + digit) with no digit count limit, resulting in O(N²) computational cost for N digits. The handle_data/2 function exacerbates this by prepending conn.buffer and re-parsing from the start on every socket message, causing repeated expensive computations. An attacker can send chunk-size hex digits in small packets over ~512,000 digits to consume over ten seconds of CPU per pass. The attack is network-reachable and requires no authentication; the malicious response looks like a normal 200 HTTP status to intermediaries that only inspect headers.
Affected products
- elixir-mint mint 1.9.3 before 1.10.0
Timeline
- 2026-09-04: disclosed