Eric Meadows-Jönsson

**Name of the Vulnerable Software and Affected Versions** Elixir versions 1.5.0 through 1.20.0 **Description** Uncontrolled Resource Consumption in the standard library's Version module allows an attacker to cause a denial of service via CPU and memory exhaustion. The version parser converts numeric components to integers without bounding their length, forcing a super-linear, non-yielding base-10 to arbitrary-precision integer conversion through `String.to integer/1` (also known as `:erlang.binary to integer/1`). This process pins a BEAM scheduler, and larger components can trigger an uncaught `SystemLimitError` that crashes the calling process. A string of approximately one megabyte is sufficient to trigger this issue, and no authentication is required. The issue is reachable via the `parse digits/2` routine in `lib/version.ex` and public entry points including `Version.parse/1`, `Version.parse!/1`, `Version.match?/3`, `Version.compare/2`, and `Version.parse requirement/1`. **Recommendations** Update to version 1.20.1.

**Name of the Vulnerable Software and Affected Versions** mint versions 0.1.0 through 1.8.x **Description** Improper Neutralization of CRLF Sequences, also known as CRLF Injection, allows HTTP Request Splitting and HTTP Request Smuggling. In the `encode request line/2` function within `lib/mint/http1/request.ex`, the `method` and `target` arguments are spliced directly into the HTTP/1 request line without character validation. Applications forwarding attacker-controlled input as the HTTP method or target to the `Mint.HTTP.request/5` function are exposed to request-line CRLF injection. This enables an attacker to terminate the request line prematurely, inject arbitrary headers, and smuggle a separate pipelined HTTP request over the same TCP connection. While the `validate request target/2` function introduced in version 1.7.0 rejects CRLF and control characters in the `target` by default, the `method` field remains unvalidated across all versions. **Recommendations** Update to version 1.9.0 or later.

**Name of the Vulnerable Software and Affected Versions** mint versions 0.2.0 through 1.8.x **Description** An issue exists where attacker-controlled HTTP/2 servers can exhaust memory in a client via PUSH PROMISE flooding. In the file lib/mint/http2.ex, the function `decode push promise headers and add response/5` inserts a `:reserved remote` entry into `conn.streams` for every promised stream ID. The function `assert valid promised stream id/2` only verifies that the promised ID is even and not already present, failing to consult `client settings.max concurrent streams` at the time of the promise. Because the concurrency cap is only checked when response HEADERS arrive, a server that sends PUSH PROMISE frames but withholds the matching HEADERS can pin entries in `conn.streams` without an upper bound, leading to memory exhaustion. This is possible because HTTP/2 server push is enabled by default via `client settings.enable push`. **Recommendations** Update to version 1.9.0 or later. As a temporary workaround, disable HTTP/2 server push on connections to untrusted servers by passing `client settings: [enable push: false]` to the `connect/4` function.

**Name of the Vulnerable Software and Affected Versions** mint versions 0.1.0 through 1.8.x **Description** An inconsistent interpretation of HTTP requests, known as HTTP Request/Response Smuggling, allows attacker-controlled HTTP/1 servers to desynchronize response framing on shared connections. The issue occurs because the HTTP/1 Content-Length parser, specifically the `content length header/1` function in `lib/mint/http1/parse.ex`, uses `Integer.parse/1` to process header values. This allows optional plus (+) or minus (-) sign prefixes; while negative values are rejected, inputs like `+0` or `+123` are accepted as valid lengths, contradicting RFC 7230 which permits only digits. A fronting proxy or load balancer enforcing strict grammar may reject or reframe such headers while Mint treats them as valid. When sockets are reused via keep-alive, pipelining, or pooled connections shared across requesters, this disagreement allows bytes from one response to be attributed to the next, potentially leaking data into a different consumer's response stream if the connection is shared across trust boundaries. **Recommendations** Update to version 1.9.0 or later.

**Name of the Vulnerable Software and Affected Versions** elixir-mint versions 0.1.0 through 1.8.x **Description** An issue exists where attacker-controlled HTTP/2 servers can cause memory exhaustion in a client. This occurs because the HTTP/2 receive path does not cap the accumulator when a HEADERS frame is observed without the END HEADERS flag. Subsequent CONTINUATION frames are appended to `conn.headers being processed` without per-stream size limits or frame-count limits. Additionally, `max header list size` is only enforced on outgoing requests and not on inbound header blocks. A malicious server can stream an endless sequence of CONTINUATION frames, driving the client's iolist to an arbitrary size, which leads to memory exhaustion and BEAM process death. **Recommendations** Update to version 1.9.0 or later. Restrict connections to untrusted servers to HTTP/1 by passing `protocols: [:http1]` to the `Mint.HTTP.connect/4` function to avoid the vulnerable HTTP/2 receive path.

**Name of the Vulnerable Software and Affected Versions** ericmj decimal versions 0.1.0 through 2.x **Description** Uncontrolled Resource Consumption allows unauthenticated remote Denial of Service. The library does not bound the exponent on parsed input, meaning a decimal with an excessively large exponent can be stored without error. Subsequent calls to functions such as `Decimal.add/2`, `Decimal.sub/2`, `Decimal.div/2`, `Decimal.to integer/1`, `Decimal.round/3`, `Decimal.compare/3` with a threshold, or `Decimal.to string/2` using :normal or :xsd formats allocate memory proportional to the exponent value. This can exhaust available memory and crash the BEAM VM (the Erlang Virtual Machine). Any application accepting user-supplied decimal input for arithmetic, rounding, integer conversion, or string formatting is exposed, as a single malicious request can cause an out-of-memory crash. **Recommendations** Update to version 3.0.0 or later.