Denial of Service Vulnerability in elixir-mint HTTP Module Affects Multiple Versions

CVE-2026-56810

What is CVE-2026-56810?

The elixir-mint library's Mint.HTTP1 module is prone to a denial of service vulnerability due to unbounded allocation of memory when processing oversized chunked transfer-encoded HTTP responses. An attacker can exploit this flaw by sending an improperly sized chunk response, causing the client to accumulate data in memory without ever completing, potentially leading to an out-of-memory condition. The problem arises from how the library decodes and buffers response data based on server-provided information, which can be manipulated by an unauthenticated remote server. This vulnerability affects versions of mint from 0.5.0 up to but not including 1.9.1.

References