Eric Meadows-Jönsson

**Name of the Vulnerable Software and Affected Versions** elixir-mint versions 0.1.0 through 1.9.2 **Description** An HTTP response smuggling issue exists due to the inconsistent interpretation of HTTP requests. A malicious HTTP/1 server can desynchronize a strict intermediary and the Mint client on a pooled connection, leading to response-queue poisoning for subsequent requests sharing that connection. The `decode body()` function in `lib/mint/http1.ex` uses `Integer.parse(data, 16)` to parse the chunk-size line of a Transfer-Encoding: chunked response. While RFC 7230 forbids sign prefixes for chunk-size, `Integer.parse/2` accepts leading + or - signs. Consequently, a chunk-size line of +5 is treated as a five-byte chunk, and +0 or -0 are treated as terminating zero-length chunks, ending the message body prematurely. An RFC-strict intermediary rejects these forms, causing a disagreement on response boundaries. On pooled keep-alive connections, an attacker-influenced origin can inject bytes that the client attributes to the next legitimate response, corrupting responses for unrelated in-flight requests. This requires a topology where an RFC-strict HTTP/1 intermediary (such as a proxy, load balancer, or WAF) is positioned between the Mint client and the origin, and connections are reused. **Recommendations** Update elixir-mint to version 1.9.3 or later.

**Name of the Vulnerable Software and Affected Versions** elixir-mint versions 0.1.0 through 1.9.1 **Description** A remote HTTP/2 server can cause memory exhaustion and a denial of service on the client host. The `handle continuation/3` function in `lib/mint/http2.ex` accumulates header-block fragments from HTTP/2 CONTINUATION frames into a nesting structure that only releases upon receiving a frame with the END HEADERS flag. While there is a size limit check via `assert header block within max size/2`, the protocol allows CONTINUATION frames to have zero-length payloads. An attacker can send an unbounded chain of these zero-length frames, which bypasses the size cap and continuously increases memory consumption by adding one cons cell per frame, eventually leading to out-of-memory termination of the BEAM node. **Recommendations** Update elixir-mint to version 1.9.2 or later.

**Name of the Vulnerable Software and Affected Versions** elixir-mint versions 0.1.0 through 1.9.1 **Description** A remote HTTP server can cause a denial of service by exhausting memory on the client host. The `Mint.HTTP1.decode headers/5` and `Mint.HTTP1.decode trailer headers/4` functions accumulate parsed response headers and chunked-trailer fields into a per-request list `request.headers buffer` that persists across TCP segments. Because there is no cap on the number of headers or total bytes, and the `:erlang.decode packet(:httph bin, binary, [])` parser is used with unlimited default size limits, a malicious server can stream header or trailer lines indefinitely without sending the terminating blank line. This causes the connection state to grow without bound until the BEAM node is terminated by the operating system's out-of-memory handler. **Recommendations** Update elixir-mint to version 1.9.2 or later.

**Name of the Vulnerable Software and Affected Versions** mint versions 0.5.0 through 1.9.0 **Description** A denial of service issue exists in the `Mint.HTTP1` module. When decoding a chunked HTTP response body, the software accumulates partial fragments in the `data buffer` (an unbounded iolist) using the `add body to buffer/2` function and does not emit data until the full declared chunk length is received. Because the chunk size is parsed from the server without an upper bound, a malicious server can specify an enormous chunk size and send bytes slowly. This forces the client to buffer data indefinitely, potentially leading to an out-of-memory condition. This can be triggered when a client follows redirects, fetches user-supplied URLs, or processes webhooks. The issue is associated with the `decode body/5` function in the `lib/mint/http1.ex` file. **Recommendations** Update mint to version 1.9.1 or later.

**Name of the Vulnerable Software and Affected Versions** hpax versions 0.1.1 through 1.0.3 **Description** An inefficient algorithmic complexity issue exists during the decoding of HPACK variable-length integers. The `Elixir.HPAX.Types`:decode remaining integer/3 function, accessed via the `Elixir.HPAX`:decode/2 entry point, does not impose an upper bound on the decoded value or the number of continuation octets. Since BEAM integers use arbitrary precision, a sequence of continuation octets creates an O(N)-bit bignum, resulting in a superlinear decoding cost of approximately O(N^2). An unauthenticated attacker can exploit this by sending a small HTTP/2 header block that consumes excessive CPU and transient memory, leading to a denial-of-service amplification. **Recommendations** Update hpax to version 1.0.4 or later.

**Name of the Vulnerable Software and Affected Versions** Elixir versions 1.5.0 through 1.20.0 **Description** Uncontrolled Resource Consumption in the standard library's Version module allows an attacker to cause a denial of service via CPU and memory exhaustion. The version parser converts numeric components to integers without bounding their length, forcing a super-linear, non-yielding base-10 to arbitrary-precision integer conversion through `String.to integer/1` (also known as `:erlang.binary to integer/1`). This process pins a BEAM scheduler, and larger components can trigger an uncaught `SystemLimitError` that crashes the calling process. A string of approximately one megabyte is sufficient to trigger this issue, and no authentication is required. The issue is reachable via the `parse digits/2` routine in `lib/version.ex` and public entry points including `Version.parse/1`, `Version.parse!/1`, `Version.match?/3`, `Version.compare/2`, and `Version.parse requirement/1`. **Recommendations** Update to version 1.20.1.

**Name of the Vulnerable Software and Affected Versions** elixir-mint versions 0.1.0 through 1.8.x **Description** An issue exists where attacker-controlled HTTP/2 servers can cause memory exhaustion in a client. This occurs because the HTTP/2 receive path does not cap the accumulator when a HEADERS frame is observed without the END HEADERS flag. Subsequent CONTINUATION frames are appended to `conn.headers being processed` without per-stream size limits or frame-count limits. Additionally, `max header list size` is only enforced on outgoing requests and not on inbound header blocks. A malicious server can stream an endless sequence of CONTINUATION frames, driving the client's iolist to an arbitrary size, which leads to memory exhaustion and BEAM process death. **Recommendations** Update to version 1.9.0 or later. Restrict connections to untrusted servers to HTTP/1 by passing `protocols: [:http1]` to the `Mint.HTTP.connect/4` function to avoid the vulnerable HTTP/2 receive path.

**Name of the Vulnerable Software and Affected Versions** mint versions 0.1.0 through 1.8.x **Description** An inconsistent interpretation of HTTP requests, known as HTTP Request/Response Smuggling, allows attacker-controlled HTTP/1 servers to desynchronize response framing on shared connections. The issue occurs because the HTTP/1 Content-Length parser, specifically the `content length header/1` function in `lib/mint/http1/parse.ex`, uses `Integer.parse/1` to process header values. This allows optional plus (+) or minus (-) sign prefixes; while negative values are rejected, inputs like `+0` or `+123` are accepted as valid lengths, contradicting RFC 7230 which permits only digits. A fronting proxy or load balancer enforcing strict grammar may reject or reframe such headers while Mint treats them as valid. When sockets are reused via keep-alive, pipelining, or pooled connections shared across requesters, this disagreement allows bytes from one response to be attributed to the next, potentially leaking data into a different consumer's response stream if the connection is shared across trust boundaries. **Recommendations** Update to version 1.9.0 or later.

**Name of the Vulnerable Software and Affected Versions** mint versions 0.2.0 through 1.8.x **Description** An issue exists where attacker-controlled HTTP/2 servers can exhaust memory in a client via PUSH PROMISE flooding. In the file lib/mint/http2.ex, the function `decode push promise headers and add response/5` inserts a `:reserved remote` entry into `conn.streams` for every promised stream ID. The function `assert valid promised stream id/2` only verifies that the promised ID is even and not already present, failing to consult `client settings.max concurrent streams` at the time of the promise. Because the concurrency cap is only checked when response HEADERS arrive, a server that sends PUSH PROMISE frames but withholds the matching HEADERS can pin entries in `conn.streams` without an upper bound, leading to memory exhaustion. This is possible because HTTP/2 server push is enabled by default via `client settings.enable push`. **Recommendations** Update to version 1.9.0 or later. As a temporary workaround, disable HTTP/2 server push on connections to untrusted servers by passing `client settings: [enable push: false]` to the `connect/4` function.

**Name of the Vulnerable Software and Affected Versions** mint versions 0.1.0 through 1.8.x **Description** Improper Neutralization of CRLF Sequences, also known as CRLF Injection, allows HTTP Request Splitting and HTTP Request Smuggling. In the `encode request line/2` function within `lib/mint/http1/request.ex`, the `method` and `target` arguments are spliced directly into the HTTP/1 request line without character validation. Applications forwarding attacker-controlled input as the HTTP method or target to the `Mint.HTTP.request/5` function are exposed to request-line CRLF injection. This enables an attacker to terminate the request line prematurely, inject arbitrary headers, and smuggle a separate pipelined HTTP request over the same TCP connection. While the `validate request target/2` function introduced in version 1.7.0 rejects CRLF and control characters in the `target` by default, the `method` field remains unvalidated across all versions. **Recommendations** Update to version 1.9.0 or later.

**Name of the Vulnerable Software and Affected Versions** ericmj decimal versions 0.1.0 through 2.x **Description** Uncontrolled Resource Consumption allows unauthenticated remote Denial of Service. The library does not bound the exponent on parsed input, meaning a decimal with an excessively large exponent can be stored without error. Subsequent calls to functions such as `Decimal.add/2`, `Decimal.sub/2`, `Decimal.div/2`, `Decimal.to integer/1`, `Decimal.round/3`, `Decimal.compare/3` with a threshold, or `Decimal.to string/2` using :normal or :xsd formats allocate memory proportional to the exponent value. This can exhaust available memory and crash the BEAM VM (the Erlang Virtual Machine). Any application accepting user-supplied decimal input for arithmetic, rounding, integer conversion, or string formatting is exposed, as a single malicious request can cause an out-of-memory crash. **Recommendations** Update to version 3.0.0 or later.