Inefficient Algorithmic Complexity in Elixir Mint Product by Elixir

CVE-2026-82729

What is CVE-2026-82729?

The vulnerability in the elixir-mint library allows a remote HTTP server to exploit an inefficient algorithm for processing chunked responses. Specifically, the parse_hex_prefix function fails to impose limits on the number of hex digits processed, leading to an exponential increase in CPU usage as the input size grows. This inefficiency can be exploited through small, repeated packet transmissions, resulting in prolonged CPU exhaustion on the client side. The issue is triggered after a valid HTTP response is established, thus making it undetectable to intermediaries that only inspect headers.

References