Resource Exhaustion Vulnerability in Elixir Mint by Elixir

CVE-2026-58229

What is CVE-2026-58229?

A vulnerability in Elixir Mint allows a remote HTTP server to exhaust memory resources on the client host, potentially causing a denial of service. Due to the design of the Mint.HTTP1.decode_headers/5 and Mint.HTTP1.decode_trailer_headers/4 functions, the headers and trailer fields are accumulated without any limit. This flaw enables attackers to send an unlimited number of headers across TCP segments, ultimately overwhelming the memory until the application is terminated by the operating system's out-of-memory handler. This issue affects all Mint versions from 0.1.0 to below 1.9.2.

References