Allocation of Resources Without Limits or Throttling in Mint HTTP1

Executive Summary

CVE-2026-56810 is a vulnerability in the Mint HTTP client library for Elixir, specifically in the Mint.HTTP1 module. It arises from the way Mint handles chunked transfer-encoded HTTP responses. When a server sends a chunked response, Mint buffers the entire chunk in memory before passing it to the caller. A malicious server can exploit this by declaring an extremely large chunk size (for example, about 2 GiB) and then sending the data very slowly without completing the chunk. Because Mint waits for the full chunk to be received before processing, it accumulates all the data in memory, which can grow without limit.

This unbounded buffering can cause the client application to consume excessive memory, potentially leading to an out-of-memory condition and denial of service. The vulnerability affects Mint versions from 0.5.0 up to but not including 1.9.1.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by causing a denial of service (DoS) condition in applications using the Mint library to handle HTTP/1.1 chunked responses. An attacker controlling a remote server can exploit this by sending a maliciously crafted HTTP response with an extremely large chunk size and slow data transmission. This forces the client to buffer large amounts of data in memory, potentially exhausting system memory.

The result can be application crashes or degraded performance due to out-of-memory errors, which can disrupt service availability. Since the vulnerability can be triggered by unauthenticated remote servers, it can be exploited via redirects, user-supplied URLs, or webhook endpoints.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a denial of service caused by a malicious server sending an oversized chunked transfer-encoded HTTP response with an extremely large chunk size and slow data transmission, leading to unbounded memory growth on the client.

To detect this vulnerability on your network or system, you should monitor HTTP responses for unusually large chunk sizes in chunked transfer-encoded responses and observe client memory usage patterns when processing such responses.

Specifically, you can use network traffic analysis tools like Wireshark or tcpdump to capture HTTP traffic and filter for chunked transfer-encoding headers with large chunk sizes.

• Use tcpdump to capture HTTP traffic: tcpdump -i <interface> -s 0 -w capture.pcap 'tcp port 80 or tcp port 443'
• Analyze the capture with Wireshark and filter for 'http.chunk_size > 1000000' to identify large chunk sizes.
• Monitor client application memory usage during HTTP requests to suspicious servers using system tools like top, htop, or ps.
• Check application logs or enable debug logging in the Mint HTTP client to detect unusually large chunk sizes or slow chunk completion.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade the Mint library to version 1.9.1 or later, where the vulnerability has been fixed.

The fix ensures that chunked HTTP response data is emitted incrementally as it arrives rather than buffering entire chunks in memory, preventing unbounded memory growth.

Until you can upgrade, consider implementing network-level protections such as limiting the size of chunked HTTP responses or blocking suspicious servers that send oversized chunk sizes.

Additionally, monitor client memory usage and set resource limits to prevent out-of-memory conditions caused by malicious responses.

Useful 0 Not Useful 0