Resource Exhaustion Vulnerability in Mint by Elixir

CVE-2026-59246

What is CVE-2026-59246?

The Mint library in Elixir experiences a resource exhaustion vulnerability due to improper handling of HTTP/2 CONTINUATION frames. Attackers can exploit this flaw by sending an unbounded sequence of zero-length CONTINUATION frames, which accumulate in an ever-deepening nesting. This results in a gradual increase of memory consumption on the client side, ultimately leading to memory exhaustion and denial of service. The vulnerability is significant due to its potential for disruption when interacting with malicious HTTP/2 servers or through various network attack methods.

References