Resource Exhaustion Vulnerability in Mint by Elixir

CVE-2026-48862

What is CVE-2026-48862?

A resource exhaustion vulnerability in Mint allows attacker-controlled HTTP/2 servers to deplete memory resources in a Mint client through excessive PUSH_PROMISE flooding. The vulnerability arises from the way the Mint client manages promised stream IDs, which are added to the connection without proper checks against the configured maximum concurrent streams. This oversight enables malicious servers to pin an uncontrolled number of stream entries, potentially leading to memory exhaustion as promised streams continue to accumulate without limits. Although client_settings.max_concurrent_streams is checked at a later stage, the absence of verification at the initial promise stage opens a critical window for exploitation, particularly when connected to a hostile HTTP/2 server.

References