CVE-2026-82729: Quadratic chunk-size parsing in Mint.HTTP1.Parse allows CPU-exhaustion DoS
Inefficient Algorithmic Complexity vulnerability in elixir-mint mint allows a remote HTTP server to exhaust CPU on the client host and cause a denial of service.
parsehexprefix/2 in lib/mint/http1/parse.ex folds each hex digit of a chunked response's chunk-size field into an arbitrary-precision accumulator with acc 16 + digit and imposes no limit on the digit count. Because the accumulator grows without bound, the multiplication is not constant time and one pass over N digits costs O(N squared). handledata/2 prepends conn.buffer and re-parses from the start on every socket message, so a server that dribbles the digits out in small packets makes the client pay that cost repeatedly. A run of roughly 512,000 hex digits costs over ten seconds of CPU in a single pass, measured on stock defaults. The parser reaches this state after a valid status line and a complete, valid header section, so an intermediary inspecting only headers sees an ordinary 200 response.
This issue affects mint: from 1.9.3 before 1.10.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
elixir-mint mintto a version that resolves this vulnerability.Fixed in 1.10.0 - Upgrade
Upgrade
mintto a version that resolves this vulnerability.Fixed in 1.10.0 - Compensating control
To mitigate CPU-exhaustion DoS while upgrading, restrict or filter outbound access so untrusted/unknown remote HTTP servers cannot communicate with the mint-based client (e.g., allowlist destinations at the network/firewall/egress layer).
Event History
Frequently Asked Questions
Which deployments are exposed to this denial of service?
Clients using Mint versions from 1.9.3 before 1.10.0 are affected when they make HTTP/1 requests to a remote server that can send a crafted chunked response. The CPU exhaustion occurs on the client host, not on the server sending the response.
What does an attacker need to do to trigger the issue?
The attacker needs to control, compromise, or otherwise induce the client to connect to an HTTP server that returns a chunked response. After sending a valid status line and complete valid headers, the server sends an extremely long hexadecimal chunk-size field, preferably dribbled across small socket messages.
Would header validation or an intermediary inspecting headers detect the malicious response?
Not reliably. The parser reaches the vulnerable chunk-size parsing state only after a valid status line and complete valid header section, so the response can appear to be an ordinary 200 response at the header level.
How can teams determine whether they are affected?
Check the resolved Mint dependency version in the application or lockfile. Versions from 1.9.3 up to, but not including, 1.10.0 are affected.