CVE-2026-49754: Elixir Mint HTTP/2 DoS Vulnerability

CVE-2026-49754 Overview

CVE-2026-49754 is a resource exhaustion vulnerability in the elixir-mint Mint HTTP client library. The flaw affects Mint versions from 0.1.0 before 1.9.0. An attacker-controlled HTTP/2 server can send an unbounded stream of CONTINUATION frames following an initial HEADERS frame that lacks the END_HEADERS flag. Mint accumulates these fragments without any size or count limit, driving the client's iolist to arbitrary size. The result is memory exhaustion and termination of the Erlang BEAM process hosting the client. A single connection to a malicious endpoint is sufficient to trigger the condition.

Critical Impact
A malicious HTTP/2 server can exhaust client memory and crash the BEAM virtual machine through an uncapped CONTINUATION frame accumulator.

Affected Products

elixir-mint Mint 0.1.0 through versions before 1.9.0
Elixir and Erlang applications using Mint as an HTTP/2 client
Downstream libraries that wrap Mint for HTTP/2 connectivity

Discovery Timeline

2026-06-02 - CVE CVE-2026-49754 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-49754

Vulnerability Analysis

The vulnerability is classified as Allocation of Resources Without Limits or Throttling [CWE-770]. Mint's HTTP/2 receive path handles fragmented header blocks by buffering data across multiple frames. When a HEADERS frame arrives without the END_HEADERS flag set, Mint stores the unparsed header-block fragment in conn.headers_being_processed. Every subsequent CONTINUATION frame on the same stream appends its payload to that accumulator. The receive path imposes no upper bound on this buffer. There is no per-stream size cap and no limit on the number of CONTINUATION frames accepted per header block.

Root Cause

The max_header_list_size setting in Mint is enforced only for outgoing requests. Inbound header blocks are not checked against this value, and its default is :infinity. Because the inbound accumulator grows without throttling, a peer can dictate the buffer size. Each CONTINUATION frame can carry up to SETTINGS_MAX_FRAME_SIZE bytes as advertised by the client, and the attacker controls how many such frames to send.

Attack Vector

An attacker hosts or compromises an HTTP/2 endpoint that a Mint client connects to. The server responds to any request with a HEADERS frame that omits the END_HEADERS flag, then streams an endless sequence of CONTINUATION frames. The client accepts and buffers each fragment until the BEAM process runs out of memory and is killed. No authentication or user interaction is required beyond establishing the HTTP/2 connection. Applications that proxy outbound requests on behalf of users, fetch URLs supplied by clients, or connect to third-party APIs are exposed.

No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-2p26-p43x-fhp8 for technical details.

Detection Methods for CVE-2026-49754

Indicators of Compromise

BEAM process termination with out-of-memory errors shortly after initiating outbound HTTP/2 connections.
Sustained memory growth in Elixir or Erlang application nodes tied to a single HTTP/2 connection state.
Network captures showing inbound HTTP/2 streams with a HEADERS frame lacking END_HEADERS followed by an unusually long sequence of CONTINUATION frames.

Detection Strategies

Inspect application telemetry for abrupt BEAM scheduler memory spikes correlated with Mint connection PIDs.
Deploy network monitoring rules that count CONTINUATION frames per HTTP/2 stream and alert on thresholds exceeding expected header sizes.
Audit dependency manifests (mix.lock) across services to identify any Mint version below 1.9.0.

Monitoring Recommendations

Track per-connection memory usage for processes managing Mint state and alert on sustained growth.
Log outbound HTTP/2 endpoints contacted by services and review for connections to untrusted or user-supplied hosts.
Forward BEAM crash dumps and supervisor restart events to centralized logging for post-incident review.

How to Mitigate CVE-2026-49754

Immediate Actions Required

Upgrade Mint to version 1.9.0 or later across all Elixir and Erlang services.
Identify transitive dependencies that pin older Mint versions and update them.
Restrict outbound HTTP/2 connections to a curated allowlist of trusted endpoints where feasible.
Review services that fetch user-supplied URLs and add network egress controls to prevent connections to attacker-controlled hosts.

Patch Information

The maintainers fixed the issue in Mint 1.9.0. The fix is published in commit b662d127 and documented in the CNA advisory for CVE-2026-49754 and the OSV vulnerability record. The patch enforces bounds on the inbound header-block accumulator so that excessive CONTINUATION frames are rejected rather than buffered indefinitely.

Workarounds

If immediate upgrade is not possible, configure HTTP clients to connect only to vetted internal endpoints and block arbitrary outbound HTTP/2 traffic at the egress firewall.
Set process memory limits on supervisors that own Mint connections so a single rogue connection cannot exhaust the entire node.
Disable HTTP/2 negotiation and fall back to HTTP/1.1 for clients that interact with untrusted servers, since the vulnerability is specific to the HTTP/2 receive path.

bash

# Update Mint dependency in mix.exs
# {:mint, "~> 1.9.0"}
mix deps.update mint
mix deps.get