CVE-2026-82728
Received Received - Intake

Memory Exhaustion in Mint HTTP Client Library

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: EEF

Description
Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client host and cause a denial of service. Two HTTP/1 response-parser states accumulate server data without any cap. In lib/mint/http1.ex, decode_status_line/4 stores the unconsumed data in conn.buffer when the status line is incomplete, and decode_body/5 does the same for an unterminated chunk-extension line. Both wait for a CRLF the server never has to send, and conn.buffer is prepended to every subsequent socket message. The :max_header_list_size budget is wired only into decode_headers/5 and decode_trailer_headers/4, so neither of these states is covered by it. A malicious server, or one reached through an attacker-controlled redirect or a fetched URL, streams bytes indefinitely until the BEAM node is killed by the operating system out-of-memory handler. The chunk-extension variant is reached after a valid status line and a complete, valid header section, so an intermediary inspecting only headers sees an ordinary 200 response. This issue affects mint: from 0.1.0 before 1.10.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-82728
EUVD
EUVD-2026-71220

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
elixir mint From 0.1.0 (inc) to 1.10.0 (exc)
elixir-mint mint From 0.1.0 (inc) to 1.10.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-82728 is an Allocation of Resources Without Limits vulnerability in the elixir-mint library. It allows a remote HTTP server to exhaust memory on the client host by sending specially crafted HTTP responses. The vulnerability occurs because the HTTP/1 response parser in Mint does not enforce size limits on certain response components like status lines and chunk-extension lines. This causes the client to buffer data indefinitely, leading to memory exhaustion and a denial of service.

Detection Guidance

To detect this vulnerability, monitor for applications using vulnerable Mint versions (0.1.0 to <1.10.0) that handle HTTP requests. Check for processes consuming excessive memory or CPU due to unbounded HTTP response buffering. Use tools like `ps`, `top`, or `htop` to identify suspicious processes. Inspect network traffic for malformed HTTP responses with unusually long status lines or chunk extensions.

Impact Analysis

This vulnerability can impact any application using the Mint library for HTTP requests, such as those using Finch, Req, Tesla, or Swoosh. An attacker can exploit it by sending malicious responses or through attacker-controlled redirects or URLs. This may cause the application to crash, the BEAM VM to terminate due to memory exhaustion, or denial-of-service conditions affecting service availability.

Compliance Impact

This vulnerability primarily causes denial-of-service conditions by exhausting memory and CPU resources, which could lead to service unavailability. For compliance standards like GDPR and HIPAA, which require availability of personal and health data systems, such disruptions may violate availability requirements and lead to potential non-compliance if systems fail to maintain expected uptime or data accessibility.

Mitigation Strategies

Upgrade Mint to version 1.10.0 or later immediately. If upgrading is not possible, implement network-level mitigations like rate limiting or blocking suspicious traffic. Review applications using Mint (e.g., Finch, Req, Tesla) for patches. Monitor BEAM VM memory usage closely to detect potential exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82728. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart