{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-59246", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-07-04T04:24:03.652Z", "datePublished": "2026-07-14T08:37:04.609Z", "dateUpdated": "2026-07-14T08:37:04.609Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Mint.HTTP2'"], "packageName": "mint", "packageURL": "pkg:hex/mint", "product": "mint", "programFiles": ["lib/mint/http2.ex"], "programRoutines": [{"name": "'Elixir.Mint.HTTP2':handle_continuation/3"}, {"name": "'Elixir.Mint.HTTP2':assert_header_block_within_max_size/2"}], "repo": "https://github.com/elixir-mint/mint", "vendor": "elixir-mint", "versions": [{"lessThan": "1.9.2", "status": "affected", "version": "0.1.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Mint.HTTP2'"], "packageName": "elixir-mint/mint", "packageURL": "pkg:github/elixir-mint/mint", "product": "mint", "programFiles": ["lib/mint/http2.ex"], "programRoutines": [{"name": "'Elixir.Mint.HTTP2':handle_continuation/3"}, {"name": "'Elixir.Mint.HTTP2':assert_header_block_within_max_size/2"}], "repo": "https://github.com/elixir-mint/mint", "vendor": "elixir-mint", "versions": [{"lessThan": "5779de1666344b32aefc4354184ea07f902f73ce", "status": "affected", "version": "596ca4304504be68939c4929e0831557097962b8", "versionType": "git"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.9.2", "versionStartIncluding": "0.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "finder", "value": "zx (Jace)"}, {"lang": "en", "type": "remediation developer", "value": "Andrea Leopardi"}, {"lang": "en", "type": "remediation reviewer", "value": "Eric Meadows-J\u00f6nsson"}, {"lang": "en", "type": "analyst", "value": "Jonatan M\u00e4nnchen / EEF"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Allocation of resources without limits vulnerability in elixir-mint mint allows a remote HTTP/2 server to exhaust memory on the client host and cause a denial of service.</p><p>The <tt>Mint.HTTP2.handle_continuation/3</tt> function in <tt>lib/mint/http2.ex</tt> accumulates the header-block fragment carried by each HTTP/2 <tt>CONTINUATION</tt> frame into a growing <tt>conn.headers_being_processed</tt> nesting, one level deeper per frame, and only releases it when a frame with the <tt>END_HEADERS</tt> flag arrives. The only guard on this accumulator is <tt>Mint.HTTP2.assert_header_block_within_max_size/2</tt>, which sums the byte size of the fragments received so far. Because a <tt>CONTINUATION</tt> frame is permitted by the protocol to carry a zero-length payload, an unbounded chain of zero-length <tt>CONTINUATION</tt> frames adds no bytes to the running total, never trips the size cap, and never emits <tt>END_HEADERS</tt>, yet each frame still nests the accumulator one level deeper.</p><p>A malicious HTTP/2 server (reachable directly, via an attacker-controlled redirect, via SSRF, or via a man-in-the-middle) can open a stream by sending a <tt>HEADERS</tt> frame without <tt>END_HEADERS</tt> and then stream zero-length <tt>CONTINUATION</tt> frames indefinitely. Client memory grows one cons cell per frame received; sustained bandwidth from the peer drives the BEAM node running the Mint client to memory exhaustion and eventual out-of-memory termination.</p><p>This issue affects mint: from 0.1.0 before 1.9.2.</p>"}], "value": "Allocation of resources without limits vulnerability in elixir-mint mint allows a remote HTTP/2 server to exhaust memory on the client host and cause a denial of service.\n\nThe Mint.HTTP2.handle_continuation/3 function in lib/mint/http2.ex accumulates the header-block fragment carried by each HTTP/2 CONTINUATION frame into a growing conn.headers_being_processed nesting, one level deeper per frame, and only releases it when a frame with the END_HEADERS flag arrives. The only guard on this accumulator is Mint.HTTP2.assert_header_block_within_max_size/2, which sums the byte size of the fragments received so far. Because a CONTINUATION frame is permitted by the protocol to carry a zero-length payload, an unbounded chain of zero-length CONTINUATION frames adds no bytes to the running total, never trips the size cap, and never emits END_HEADERS, yet each frame still nests the accumulator one level deeper.\n\nA malicious HTTP/2 server (reachable directly, via an attacker-controlled redirect, via SSRF, or via a man-in-the-middle) can open a stream by sending a HEADERS frame without END_HEADERS and then stream zero-length CONTINUATION frames indefinitely. Client memory grows one cons cell per frame received; sustained bandwidth from the peer drives the BEAM node running the Mint client to memory exhaustion and eventual out-of-memory termination.\n\nThis issue affects mint: from 0.1.0 before 1.9.2."}], "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130 Excessive Allocation"}]}], "metrics": [{"cvssV4_0": {"attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 6.3, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-07-14T08:37:04.609Z"}, "references": [{"tags": ["vendor-advisory", "related"], "url": "https://github.com/elixir-mint/mint/security/advisories/GHSA-8pf6-g464-h6h9"}, {"tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-59246.html"}, {"tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-59246"}, {"tags": ["patch"], "url": "https://github.com/elixir-mint/mint/commit/5779de1666344b32aefc4354184ea07f902f73ce"}], "source": {"discovery": "EXTERNAL"}, "title": "Zero-length HTTP/2 CONTINUATION frames bypass Mint's header-block byte-size cap and exhaust client memory", "x_generator": {"engine": "cvelib 1.8.0"}}}}

{}

{}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.1.0,1.9.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[596ca4304504be68939c4929e0831557097962b8,5779de1666344b32aefc4354184ea07f902f73ce)"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "mint", "vendor": "elixir-mint"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.1.0,1.9.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "mint", "source": "cna", "vendor": "elixir-mint"}, "product": "mint", "vendor": "elixir-mint"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[596ca4304504be68939c4929e0831557097962b8,5779de1666344b32aefc4354184ea07f902f73ce)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "mint", "source": "cna", "vendor": "elixir-mint"}, "product": "mint", "vendor": "elixir-mint"}], "created": "2026-07-14T10:30:08.958675+00:00", "updated": "2026-07-14T10:30:08.958722+00:00", "vendors": ["elixir-mint", "elixir-mint$PRODUCT$mint"]}