PT-2026-45787 · Unknown · Elixir-Mint

Eric Meadows-Jönsson + 1 · Published 2026-06-02 · Updated 2026-06-02 · CVE-2026-49754

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions elixir-mint versions 0.1.0 through 1.8.x

Description An issue exists where attacker-controlled HTTP/2 servers can cause memory exhaustion in a client. This occurs because the HTTP/2 receive path does not cap the accumulator when a HEADERS frame is observed without the END HEADERS flag. Subsequent CONTINUATION frames are appended to conn.headers being processed without per-stream size limits or frame-count limits. Additionally, max header list size is only enforced on outgoing requests and not on inbound header blocks. A malicious server can stream an endless sequence of CONTINUATION frames, driving the client's iolist to an arbitrary size, which leads to memory exhaustion and BEAM process death.

Recommendations Update to version 1.9.0 or later. Restrict connections to untrusted servers to HTTP/1 by passing protocols: [:http1] to the Mint.HTTP.connect/4 function to avoid the vulnerable HTTP/2 receive path.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-49754

GHSA-2P26-P43X-FHP8

Affected Products

Elixir-Mint

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-49754 · Security Note
• https://github.com/elixir-mint/mint/commit/b662d127d3028b5426c88d4c9cc7fe430491a10b · Patch
• https://osv.dev/vulnerability/EEF-CVE-2026-49754 · Vendor Advisory
• https://github.com/elixir-mint/mint/security/advisories/GHSA-2p26-p43x-fhp8 · Vendor Advisory
• https://hex.pm/packages/mint · Note
• https://cna.erlef.org/cves/CVE-2026-49754.html · Note