Denial of Service Vulnerability in Elixir Mint HTTP Client

CVE-2026-82728

What is CVE-2026-82728?

A vulnerability in the Elixir Mint HTTP client allows remote servers to exhaust memory resources on the client host, potentially leading to a denial of service. The flaw arises from the handling of HTTP/1 response parsing, where the states can accumulate server data without limits. Specifically, when the status line or chunk extension line is incomplete, data builds up in the connection buffer without a proper cap, making the system susceptible to being overwhelmed by data streams from a malicious server. This situation can occur via a direct interaction or through an attacker-controlled redirect, ultimately causing the BEAM node to crash due to out-of-memory conditions.

References