CVE-2026-48862: Elixir Mint HTTP/2 DoS Vulnerability

CVE-2026-48862 Overview

CVE-2026-48862 is a resource exhaustion vulnerability in the elixir-mint Mint HTTP client library. A hostile HTTP/2 server can flood a Mint client with PUSH_PROMISE frames over a single long-lived connection, pinning one conn.streams entry per promise until the client process exhausts memory. The issue affects mint from version 0.2.0 before 1.9.0 and is classified as [CWE-770] Allocation of Resources Without Limits or Throttling. HTTP/2 server push is accepted by default because client_settings.enable_push defaults to true, so any Mint-based client connecting to an attacker-controlled HTTP/2 endpoint is exposed.

Critical Impact
A single malicious HTTP/2 server can drive a Mint client process to out-of-memory termination by sending unbounded PUSH_PROMISE frames without follow-up HEADERS.

Affected Products

elixir-mint Mint >= 0.2.0, < 1.9.0
Elixir applications using Mint directly for HTTP/2 client connections
Higher-level libraries that depend on Mint as their HTTP transport (for example Finch-based stacks)

Discovery Timeline

2026-06-02 - CVE-2026-48862 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-48862

Vulnerability Analysis

The defect lives in lib/mint/http2.ex. The function Mint.HTTP2.decode_push_promise_headers_and_add_response/5 inserts a :reserved_remote entry into conn.streams for every promised stream ID announced by the server. The companion check Mint.HTTP2.assert_valid_promised_stream_id/2 only validates that the promised stream ID is even and not already tracked. It does not consult client_settings.max_concurrent_streams at promise time.

Mint defers the concurrency cap evaluation until the response HEADERS for a promised stream arrive. A server that emits PUSH_PROMISE frames and never sends the matching HEADERS frames bypasses that check entirely. Each promised stream remains in the :reserved_remote state and continues to consume memory in the client process map.

Root Cause

The root cause is missing enforcement of the HTTP/2 concurrency limit on reserved remote streams. The protocol state machine accepts unbounded reservations because the throttle is keyed off response receipt rather than promise receipt. Combined with enable_push defaulting to true, the client accepts pushes by default with no upper bound on outstanding reservations.

Attack Vector

An attacker who controls an HTTP/2 server, or who can coerce a Mint client to connect to one, opens a single HTTP/2 connection and emits a continuous stream of PUSH_PROMISE frames with monotonically increasing even stream IDs. The attacker withholds the corresponding HEADERS frames. Each frame causes Mint to allocate and retain a :reserved_remote stream entry. Memory consumption in the BEAM process grows linearly with the number of promises until the Erlang VM terminates the process or the host runs out of memory. The attack requires only network reach to the client and no authentication. See the GitHub Security Advisory GHSA-g586-ccqf-7x4r for the upstream description.

Detection Methods for CVE-2026-48862

Indicators of Compromise

Sustained growth of BEAM process memory tied to a single outbound HTTP/2 connection
High counts of PUSH_PROMISE frames received from a remote peer without matching HEADERS frames
Long-lived HTTP/2 sessions to untrusted or third-party hosts where the conn.streams map size grows monotonically

Detection Strategies

Inspect HTTP/2 traffic at the proxy or service mesh layer for an imbalance between PUSH_PROMISE and follow-up HEADERS frames per connection.
Instrument Mint-using applications with telemetry on stream table size and alert when :reserved_remote entries exceed expected concurrency.
Use dependency scanning to flag any mint version between 0.2.0 and 1.9.0 in build manifests and lockfiles.

Monitoring Recommendations

Track per-process memory and message queue length on Elixir nodes that initiate HTTP/2 client connections.
Log and rate-limit HTTP/2 server-push activity at egress proxies that front Mint-based services.
Correlate sudden out-of-memory restarts of Elixir workers with the remote peers of their active HTTP/2 sockets.

How to Mitigate CVE-2026-48862

Immediate Actions Required

Upgrade mint to version 1.9.0 or later in all Elixir applications and transitive dependencies.
For applications that do not require HTTP/2 server push, disable it by passing client_settings: [enable_push: false] to Mint.HTTP.connect/4.
Audit outbound HTTP/2 destinations and restrict Mint clients to trusted endpoints until patching is complete.

Patch Information

The fix is delivered in mint 1.9.0. Upstream changes are tracked in the GitHub Mint Commit Update and described in the CNA CVE-2026-48862 Listing. Cross-ecosystem metadata is available at the OSV Vulnerability EEF-CVE-2026-48862 record.

Workarounds

Set enable_push: false in client_settings to refuse server push entirely on new connections.
Terminate HTTP/2 connections after a fixed number of streams or a short idle interval to bound memory exposure.
Route outbound HTTP/2 traffic through a reverse proxy that drops or rate-limits PUSH_PROMISE frames.

bash

# Configuration example: pin Mint >= 1.9.0 and disable HTTP/2 server push
# mix.exs
# {:mint, "~> 1.9"}

# Application code
{:ok, conn} = Mint.HTTP.connect(:https, "example.com", 443,
  protocols: [:http2],
  client_settings: [enable_push: false]
)