MediumFix available

Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size

Type: advisorySource: OSV1 source record

## Summary Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to make the client hold up to about 16 MiB per connection in frames it should reject, consuming client memory. `Mint.HTTP2.Frame.decode_next/2` in `lib/mint/http2/frame.ex` compares a frame with the client's `max_frame_size` (16,384 bytes by default) only once the whole declared payload has arrived. Until then it returns `:more`, and `Mint.HTTP2` keeps every received byte in the connection buffer. A server can declare a frame length of up to 16,777,215 bytes and withhold the last byte, keeping roughly 1,024 times the advertised limit buffered for as long as the connection stays open. The server has to send every byte the client buffers, so there is no amplification, and the buffer stops at the 24-bit frame length limit. This issue affects mint: from 0.1.0 before 1.10.2. ## Details **1. Late size check.** `Mint.HTTP2.Frame.decode_next/2` calls `decode_next_raw/1`, whose binary pattern only matches once the full declared payload is present. The `max_frame_size` guard runs on the matched payload, so a partial frame of any declared length returns `:more`. **2. Unbounded buffering.** On `:more`, `Mint.HTTP2.handle_new_data/3` stores the accumulated data in `conn.buffer`, and `maybe_concat_and_handle_new_data/2` prepends it to every later socket read, in both `stream/2` (active mode) and `recv/3` (passive mode). Nothing caps the buffer. **3. No release.

Announced 28 Sept 2026Source revision 1

Original source ↗

EEF-CVE-2026-92103

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:EEF-CVE-2026-92103

mint

Source reference: /affected/0/package/name

Affected versions: 0.1.0
Source reference: /affected/0/versions
0.2.0
Source reference: /affected/0/versions
0.2.1
Source reference: /affected/0/versions
0.3.0
Source reference: /affected/0/versions
0.4.0
Source reference: /affected/0/versions
0.5.0
Source reference: /affected/0/versions
1.0.0
Source reference: /affected/0/versions
1.1.0
Source reference: /affected/0/versions
1.10.0
Source reference: /affected/0/versions
1.10.1
Source reference: /affected/0/versions
1.2.0
Source reference: /affected/0/versions
1.2.1
Source reference: /affected/0/versions
1.3.0
Source reference: /affected/0/versions
1.4.0
Source reference: /affected/0/versions
1.4.1
Source reference: /affected/0/versions
1.4.2
Source reference: /affected/0/versions
1.5.0
Source reference: /affected/0/versions
1.5.1
Source reference: /affected/0/versions
1.5.2
Source reference: /affected/0/versions
1.6.0
Source reference: /affected/0/versions
1.6.1
Source reference: /affected/0/versions
1.6.2
Source reference: /affected/0/versions
1.7.0
Source reference: /affected/0/versions
1.7.1
Source reference: /affected/0/versions
1.8.0
Source reference: /affected/0/versions
1.9.0
Source reference: /affected/0/versions
1.9.1
Source reference: /affected/0/versions
1.9.2
Source reference: /affected/0/versions
1.9.3
Source reference: /affected/0/versions
Fixed versions: 1.10.2
Source reference: /affected/0/ranges
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0.1.0"
          },
          {
            "fixed": "1.10.2"
          }
        ]
      }
    ],
    "package": {
      "name": "mint",
      "purl": "pkg:hex/mint",
      "ecosystem": "Hex"
    },
    "versions": [
      "0.1.0",
      "0.2.0",
      "0.2.1",
      "0.3.0",
      "0.4.0",
      "0.5.0",
      "1.0.0",
      "1.1.0",
      "1.10.0",
      "1.10.1",
      "1.2.0",
      "1.2.1",
      "1.3.0",
      "1.4.0",
      "1.4.1",
      "1.4.2",
      "1.5.0",
      "1.5.1",
      "1.5.2",
      "1.6.0",
      "1.6.1",
      "1.6.2",
      "1.7.0",
      "1.7.1",
      "1.8.0",
      "1.9.0",
      "1.9.1",
      "1.9.2",
      "1.9.3"
    ],
    "database_specific": {
      "source": "https://cna.erlef.org/osv/EEF-CVE-2026-92103.json"
    }
  },
  {
    "ranges": [
      {
        "repo": "https://github.com/elixir-mint/mint",
        "type": "GIT",
        "events": [
          {
            "introduced": "596ca4304504be68939c4929e0831557097962b8"
          },
          {
            "fixed": "20252ca85065f4d1092aed9ee4ed21841a507dfe"
          },
          {
            "fixed": "44d7ce4755d0444ee415cbcca7ce4942382da4dd"
          }
        ]
      }
    ],
    "versions": [
      "v1.10.1",
      "v1.10.0",
      "v1.9.3",
      "v1.9.2",
      "v1.9.1",
      "v1.9.0",
      "v1.8.0",
      "v1.7.1",
      "v1.7.0",
      "v1.6.2",
      "v1.6.1",
      "v1.6.0",
      "v1.5.2",
      "v1.5.1",
      "v1.5.0",
      "v1.4.2",
      "v1.4.1",
      "v1.4.0",
      "v1.3.0",
      "v1.2.1",
      "v1.2.0",
      "v1.1.0",
      "v1.0.0",
      "v0.5.0",
      "v0.4.0",
      "v0.2.1",
      "v0.2.0",
      "v0.1.0"
    ],
    "database_specific": {
      "source": "https://cna.erlef.org/osv/EEF-CVE-2026-92103.json"
    }
  }
]

Related CVEs: CVE-2026-92103
Source reference: /aliases

Publisher severity

No explicit severity was provided.

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-92103 · Medium

mint, mint

Event: #27679 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 07:29:28 GMT
Publisher date: Mon, 28 Sep 2026 11:15:20 GMT

Read the original announcement