PT-2026-45785 · Mint · Mint

Eric Meadows-Jönsson

+1

·

Published

2026-06-02

·

Updated

2026-06-02

·

CVE-2026-48862

CVSS v4.0

8.2

High

VectorAV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions mint versions 0.2.0 through 1.8.x
Description An issue exists where attacker-controlled HTTP/2 servers can exhaust memory in a client via PUSH PROMISE flooding. In the file lib/mint/http2.ex, the function decode push promise headers and add response/5 inserts a :reserved remote entry into conn.streams for every promised stream ID. The function assert valid promised stream id/2 only verifies that the promised ID is even and not already present, failing to consult client settings.max concurrent streams at the time of the promise. Because the concurrency cap is only checked when response HEADERS arrive, a server that sends PUSH PROMISE frames but withholds the matching HEADERS can pin entries in conn.streams without an upper bound, leading to memory exhaustion. This is possible because HTTP/2 server push is enabled by default via client settings.enable push.
Recommendations Update to version 1.9.0 or later. As a temporary workaround, disable HTTP/2 server push on connections to untrusted servers by passing client settings: [enable push: false] to the connect/4 function.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-48862
GHSA-G586-CCQF-7X4R

Affected Products

Mint