Executive Summary

CVE-2026-48862 is a high-severity vulnerability in the Mint HTTP/2 client library for Elixir, affecting versions from 0.2.0 up to but not including 1.9.0. The issue arises because the client accepts HTTP/2 PUSH_PROMISE frames from servers without enforcing the maximum concurrency limit at the time of receiving these frames.

Specifically, each PUSH_PROMISE frame causes the client to reserve a stream ID in its internal connection streams map without checking the configured maximum concurrent streams limit. The concurrency limit is only checked later when the corresponding response HEADERS arrive. A malicious server can exploit this by sending many PUSH_PROMISE frames without sending the matching HEADERS, causing the client's memory to grow unbounded as it reserves more and more streams.

This leads to memory exhaustion in the client process, potentially causing crashes or denial of service. The vulnerability is remotely exploitable without authentication or user interaction, and HTTP/2 server push is enabled by default, making all clients using Mint vulnerable unless mitigated.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts the availability of the Mint HTTP/2 client by allowing an attacker-controlled server to exhaust client memory through unbounded PUSH_PROMISE frames, leading to potential denial of service.

There is no direct information in the provided context or resources about how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing a malicious HTTP/2 server to exhaust the memory of any Mint HTTP/2 client process that connects to it. By sending a large number of PUSH_PROMISE frames without corresponding HEADERS, the server causes the client to reserve streams indefinitely, consuming increasing amounts of memory.

The result is a denial of service condition where the client process may crash or become unresponsive due to memory exhaustion. This affects the availability of applications relying on Mint for HTTP/2 communication.

• Remote exploitation without authentication or user interaction.
• Memory exhaustion leading to client crashes or unavailability.
• Potential disruption of services relying on Mint HTTP/2 client.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves unbounded growth of the conn.streams map in the Mint HTTP/2 client due to excessive PUSH_PROMISE frames from a server. Detection can focus on monitoring memory usage of the Mint client process for unusual growth or crashes.

Since the issue is triggered by a hostile HTTP/2 server sending many PUSH_PROMISE frames without corresponding HEADERS, network detection could involve capturing and analyzing HTTP/2 traffic to identify excessive PUSH_PROMISE frames from a single server connection.

Suggested commands include using network packet analyzers like tshark or Wireshark to filter HTTP/2 PUSH_PROMISE frames:

• tshark -i <interface> -Y "http2.type == 5"
• Or using Wireshark display filter: http2.type == 5 (PUSH_PROMISE frames)

Additionally, monitoring the memory consumption of the Mint client process (e.g., BEAM VM) can help detect abnormal memory growth indicative of the vulnerability being exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves disabling HTTP/2 server push in the Mint client by setting the connection option client_settings: [enable_push: false]. This prevents the client from accepting PUSH_PROMISE frames, thereby avoiding unbounded memory growth.

Alternatively, upgrading the Mint library to version 1.9.0 or later, where the vulnerability is fixed, is recommended.

The fix enforces the max_concurrent_streams limit at the time of receiving PUSH_PROMISE frames and rejects excessive promises, preventing memory exhaustion.

Useful 0 Not Useful 0