Skip to content
Heist/ feed
HighFix available

HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memory

Type: advisorySource: OSV1 source record

## Summary Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to exhaust memory on the client host and cause a denial of service. `Mint.HTTP2` enforces the client's `max_header_list_size` setting only on the compressed size of an inbound header block, while RFC 9113 section 6.5.2 defines the limit on the decoded header list. An HPACK indexed field costs one byte on the wire and decodes to a dynamic table entry of up to 4 KB, and `join_cookie_headers/1` in `lib/mint/http2.ex` copies every `cookie` value of a response into one new binary. A header block under the default 256 KB wire limit therefore makes the client allocate about 1 GB for a single response, and several such responses in one delivery exhaust the memory of the process that owns the connection or of the whole VM. This issue affects mint: from 1.1.0 before 1.10.2. ## Details **1. Compressed-size check only.** `Mint.HTTP2.assert_header_block_within_max_size/2` compares the accumulated `HEADERS` plus `CONTINUATION` bytes with `client_settings.max_header_list_size`, which bounds a `CONTINUATION` chain but not the decoded size. After `HPAX.decode/2` returns, `decode_hbf_and_add_responses/5` passes the header list to `handle_decoded_headers_for_stream/5` without measuring it. The only implementation of the RFC 9113 section 6.5.2 formula, `assert_headers_smaller_than_max_header_list_size/2`, applies the server's setting to headers Mint sends. **2. Index

Announced Source revision 1
Original source ↗

EEF-CVE-2026-91043

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:EEF-CVE-2026-91043

mint

Source reference: /affected/0/package/name

Affected versions
1.1.0

Source reference: /affected/0/versions

1.10.0

Source reference: /affected/0/versions

1.10.1

Source reference: /affected/0/versions

1.2.0

Source reference: /affected/0/versions

1.2.1

Source reference: /affected/0/versions

1.3.0

Source reference: /affected/0/versions

1.4.0

Source reference: /affected/0/versions

1.4.1

Source reference: /affected/0/versions

1.4.2

Source reference: /affected/0/versions

1.5.0

Source reference: /affected/0/versions

1.5.1

Source reference: /affected/0/versions

1.5.2

Source reference: /affected/0/versions

1.6.0

Source reference: /affected/0/versions

1.6.1

Source reference: /affected/0/versions

1.6.2

Source reference: /affected/0/versions

1.7.0

Source reference: /affected/0/versions

1.7.1

Source reference: /affected/0/versions

1.8.0

Source reference: /affected/0/versions

1.9.0

Source reference: /affected/0/versions

1.9.1

Source reference: /affected/0/versions

1.9.2

Source reference: /affected/0/versions

1.9.3

Source reference: /affected/0/versions

Fixed versions
1.10.2

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "1.1.0"
          },
          {
            "fixed": "1.10.2"
          }
        ]
      }
    ],
    "package": {
      "name": "mint",
      "purl": "pkg:hex/mint",
      "ecosystem": "Hex"
    },
    "versions": [
      "1.1.0",
      "1.10.0",
      "1.10.1",
      "1.2.0",
      "1.2.1",
      "1.3.0",
      "1.4.0",
      "1.4.1",
      "1.4.2",
      "1.5.0",
      "1.5.1",
      "1.5.2",
      "1.6.0",
      "1.6.1",
      "1.6.2",
      "1.7.0",
      "1.7.1",
      "1.8.0",
      "1.9.0",
      "1.9.1",
      "1.9.2",
      "1.9.3"
    ],
    "database_specific": {
      "source": "https://cna.erlef.org/osv/EEF-CVE-2026-91043.json"
    }
  },
  {
    "ranges": [
      {
        "repo": "https://github.com/elixir-mint/mint",
        "type": "GIT",
        "events": [
          {
            "introduced": "8e0e04680476f90f9f68db4dfeabcbe66dabfc4d"
          },
          {
            "fixed": "c7895cb022196c77ec35570c8e873a84393ff4b8"
          },
          {
            "fixed": "65a0d61c9eab6b0dedac809de7212515bf506250"
          }
        ]
      }
    ],
    "versions": [
      "v1.10.1",
      "v1.10.0",
      "v1.9.3",
      "v1.9.2",
      "v1.9.1",
      "v1.9.0",
      "v1.8.0",
      "v1.7.1",
      "v1.7.0",
      "v1.6.2",
      "v1.6.1",
      "v1.6.0",
      "v1.5.2",
      "v1.5.1",
      "v1.5.0",
      "v1.4.2",
      "v1.4.1",
      "v1.4.0",
      "v1.3.0",
      "v1.2.1",
      "v1.2.0",
      "v1.1.0"
    ],
    "database_specific": {
      "source": "https://cna.erlef.org/osv/EEF-CVE-2026-91043.json"
    }
  }
]
Related CVEs
CVE-2026-91043

Source reference: /aliases

Publisher severity

No explicit severity was provided.

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-91043 · High

mint, mint

Event
#27675 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement