CVE-2026-82729
Received Received - Intake

Inefficient Algorithmic Complexity in Mint HTTP Client

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: EEF

Description
Inefficient Algorithmic Complexity vulnerability in elixir-mint mint allows a remote HTTP server to exhaust CPU on the client host and cause a denial of service. parse_hex_prefix/2 in lib/mint/http1/parse.ex folds each hex digit of a chunked response's chunk-size field into an arbitrary-precision accumulator with acc * 16 + digit and imposes no limit on the digit count. Because the accumulator grows without bound, the multiplication is not constant time and one pass over N digits costs O(N squared). handle_data/2 prepends conn.buffer and re-parses from the start on every socket message, so a server that dribbles the digits out in small packets makes the client pay that cost repeatedly. A run of roughly 512,000 hex digits costs over ten seconds of CPU in a single pass, measured on stock defaults. The parser reaches this state after a valid status line and a complete, valid header section, so an intermediary inspecting only headers sees an ordinary 200 response. This issue affects mint: from 1.9.3 before 1.10.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-82729
EUVD
EUVD-2026-71219

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
elixir-mint mint From 1.9.3 (inc) to 1.10.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-82729 is an inefficient algorithmic complexity vulnerability in the elixir-mint library's HTTP/1.1 parsing component. It involves quadratic chunk-size parsing where a malicious server sends an excessively long hexadecimal chunk size field in a chunked HTTP response. This causes the client to repeatedly re-parse the growing field, leading to O(N^2) CPU and memory usage. The attack can exhaust system resources and deny service to legitimate operations.

Detection Guidance

Check Mint library version with mix deps | grep mint. Monitor CPU usage spikes during HTTP requests. Inspect network traffic for chunked responses with abnormally long hexadecimal chunk-size fields. Use tools like Wireshark to analyze HTTP/1.1 responses for excessive chunk sizes.

Impact Analysis

This vulnerability can impact applications using the Mint library to fetch attacker-controlled URLs, such as webhooks or link unfurlers. An attacker could send a specially crafted HTTP response to exhaust CPU resources, crash the process, or cause a denial of service. Systems running vulnerable versions (1.9.3 to 1.9.9) are at risk if they handle untrusted HTTP responses.

Compliance Impact

This vulnerability primarily causes denial-of-service through CPU exhaustion, which could disrupt services handling sensitive data. For GDPR, it may impact availability of personal data processing systems. For HIPAA, it could affect the availability of systems handling protected health information. Compliance may be impacted if the DoS disrupts required access to data or systems.

Mitigation Strategies

Upgrade Mint to version 1.10.0 or later. If upgrading is not possible, disable chunked transfer encoding in client applications or implement rate limiting for incoming HTTP responses. Monitor affected applications for abnormal CPU usage.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82729. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart