Andrea Leopardi

**Name of the Vulnerable Software and Affected Versions** elixir-mint versions 0.1.0 through 1.9.2 **Description** An HTTP response smuggling issue exists due to the inconsistent interpretation of HTTP requests. A malicious HTTP/1 server can desynchronize a strict intermediary and the Mint client on a pooled connection, leading to response-queue poisoning for subsequent requests sharing that connection. The `decode body()` function in `lib/mint/http1.ex` uses `Integer.parse(data, 16)` to parse the chunk-size line of a Transfer-Encoding: chunked response. While RFC 7230 forbids sign prefixes for chunk-size, `Integer.parse/2` accepts leading + or - signs. Consequently, a chunk-size line of +5 is treated as a five-byte chunk, and +0 or -0 are treated as terminating zero-length chunks, ending the message body prematurely. An RFC-strict intermediary rejects these forms, causing a disagreement on response boundaries. On pooled keep-alive connections, an attacker-influenced origin can inject bytes that the client attributes to the next legitimate response, corrupting responses for unrelated in-flight requests. This requires a topology where an RFC-strict HTTP/1 intermediary (such as a proxy, load balancer, or WAF) is positioned between the Mint client and the origin, and connections are reused. **Recommendations** Update elixir-mint to version 1.9.3 or later.

**Name of the Vulnerable Software and Affected Versions** elixir-mint versions 0.1.0 through 1.9.1 **Description** A remote HTTP server can cause a denial of service by exhausting memory on the client host. The `Mint.HTTP1.decode headers/5` and `Mint.HTTP1.decode trailer headers/4` functions accumulate parsed response headers and chunked-trailer fields into a per-request list `request.headers buffer` that persists across TCP segments. Because there is no cap on the number of headers or total bytes, and the `:erlang.decode packet(:httph bin, binary, [])` parser is used with unlimited default size limits, a malicious server can stream header or trailer lines indefinitely without sending the terminating blank line. This causes the connection state to grow without bound until the BEAM node is terminated by the operating system's out-of-memory handler. **Recommendations** Update elixir-mint to version 1.9.2 or later.

**Name of the Vulnerable Software and Affected Versions** elixir-mint versions 0.1.0 through 1.9.1 **Description** A remote HTTP/2 server can cause memory exhaustion and a denial of service on the client host. The `handle continuation/3` function in `lib/mint/http2.ex` accumulates header-block fragments from HTTP/2 CONTINUATION frames into a nesting structure that only releases upon receiving a frame with the END HEADERS flag. While there is a size limit check via `assert header block within max size/2`, the protocol allows CONTINUATION frames to have zero-length payloads. An attacker can send an unbounded chain of these zero-length frames, which bypasses the size cap and continuously increases memory consumption by adding one cons cell per frame, eventually leading to out-of-memory termination of the BEAM node. **Recommendations** Update elixir-mint to version 1.9.2 or later.

**Name of the Vulnerable Software and Affected Versions** mint versions 0.5.0 through 1.9.0 **Description** A denial of service issue exists in the `Mint.HTTP1` module. When decoding a chunked HTTP response body, the software accumulates partial fragments in the `data buffer` (an unbounded iolist) using the `add body to buffer/2` function and does not emit data until the full declared chunk length is received. Because the chunk size is parsed from the server without an upper bound, a malicious server can specify an enormous chunk size and send bytes slowly. This forces the client to buffer data indefinitely, potentially leading to an out-of-memory condition. This can be triggered when a client follows redirects, fetches user-supplied URLs, or processes webhooks. The issue is associated with the `decode body/5` function in the `lib/mint/http1.ex` file. **Recommendations** Update mint to version 1.9.1 or later.

**Name of the Vulnerable Software and Affected Versions** hpax versions 0.1.1 through 1.0.3 **Description** An inefficient algorithmic complexity issue exists during the decoding of HPACK variable-length integers. The `Elixir.HPAX.Types`:decode remaining integer/3 function, accessed via the `Elixir.HPAX`:decode/2 entry point, does not impose an upper bound on the decoded value or the number of continuation octets. Since BEAM integers use arbitrary precision, a sequence of continuation octets creates an O(N)-bit bignum, resulting in a superlinear decoding cost of approximately O(N^2). An unauthenticated attacker can exploit this by sending a small HTTP/2 header block that consumes excessive CPU and transient memory, leading to a denial-of-service amplification. **Recommendations** Update hpax to version 1.0.4 or later.