CVE-2026-82728: Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS
Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client host and cause a denial of service.
Two HTTP/1 response-parser states accumulate server data without any cap. In lib/mint/http1.ex, decodestatusline/4 stores the unconsumed data in conn.buffer when the status line is incomplete, and decodebody/5 does the same for an unterminated chunk-extension line. Both wait for a CRLF the server never has to send, and conn.buffer is prepended to every subsequent socket message. The :maxheaderlistsize budget is wired only into decodeheaders/5 and decodetrailerheaders/4, so neither of these states is covered by it. A malicious server, or one reached through an attacker-controlled redirect or a fetched URL, streams bytes indefinitely until the BEAM node is killed by the operating system out-of-memory handler. The chunk-extension variant is reached after a valid status line and a complete, valid header section, so an intermediary inspecting only headers sees an ordinary 200 response.
This issue affects mint: from 0.1.0 before 1.10.0.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this denial of service?
Clients using affected Mint versions from 0.1.0 before 1.10.0 are exposed when they connect to an HTTP/1 server that can send a deliberately incomplete status line or unterminated chunk-extension line. This includes connections to malicious servers and requests redirected to, or URLs fetched from, attacker-controlled destinations.
Does limiting max_header_list_size mitigate this issue?
No. The max_header_list_size budget applies to header and trailer-header parsing, but not to incomplete status lines or chunk-extension lines, where the unconsumed data is accumulated without a cap.
What must an attacker do to trigger the issue?
The attacker must control the HTTP/1 response stream and continuously send bytes without the CRLF that terminates the relevant parser line. For the chunk-extension path, they first send a valid status line and complete valid headers, then provide an unterminated chunk-extension line.
How severe can the impact be on an affected client?
Buffered data grows as additional socket messages arrive until memory is exhausted. The BEAM node can then be terminated by the operating system's out-of-memory handler.
How can this be addressed?
Update Mint to version 1.10.0 or later. The affected range is 0.1.0 through versions before 1.10.0.