Resource Exhaustion Vulnerability in Elixir-Mint Client

CVE-2026-49754

What is CVE-2026-49754?

The Elixir-Mint client suffers from a vulnerability allowing attackers to exploit its HTTP/2 receive path. This flaw permits malicious HTTP/2 servers to send a continuous stream of CONTINUATION frames, which can lead to memory exhaustion in the client application. Since no limits are imposed on the size or quantity of incoming CONTINUATION frames, the attacker can cause significant disruption by effectively driving the client's memory usage to maximum capacity. This vulnerability can be exploited using just a single connection to an attacker-controlled HTTP/2 server, resulting in the failure of processes within the Erlang BEAM environment. Users of affected Mint versions should review security updates and consider implementing compensatory measures.

References