CVE-2026-56810: Elixir Mint HTTP1 DoS Vulnerability

CVE-2026-56810 Overview

CVE-2026-56810 is an Allocation of Resources Without Limits or Throttling vulnerability [CWE-770] in the elixir-mint HTTP client library. The flaw resides in the Mint.HTTP1 module and affects mint versions from 0.5.0 before 1.9.1. When Mint decodes a chunked HTTP response body, it accumulates each partial fragment in an unbounded iolist buffer and does not emit data to the caller until the full declared chunk length has been received. A malicious or compromised server can announce an enormous chunk size and then trickle bytes slowly, forcing the client to consume arbitrary amounts of memory. This condition results in a denial-of-service state through out-of-memory (OOM) termination of the client process.

Critical Impact
An unauthenticated remote server can drive an elixir-mint client to unbounded memory growth and trigger an out-of-memory crash, resulting in denial of service for any application that follows redirects, fetches user-supplied URLs, or processes webhooks.

Affected Products

elixir-mint/mint versions 0.5.0 through 1.9.0
Elixir and Erlang applications using Mint.HTTP1 for HTTP/1.x connections
Downstream libraries wrapping Mint (for example, HTTP client stacks that use Mint as a transport)

Discovery Timeline

2026-07-06 - CVE-2026-56810 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-56810

Vulnerability Analysis

The vulnerability affects the chunked transfer-encoded response handling path in lib/mint/http1.ex. The routines Elixir.Mint.HTTP1:decode_body/5 and Elixir.Mint.HTTP1:add_body_to_buffer/2 accumulate incoming chunk fragments into the connection's data_buffer, an unbounded iolist. Mint withholds body data from the calling application until the declared chunk length is fully received.

Because Mint parses the chunk size directly from the server with no upper bound, a server can advertise a chunk size such as 7FFFFFFF (roughly 2 GiB) and then dribble body bytes without ever completing the chunk. Applications that rely on content-length streaming for safety receive no protection here, because no data responses are emitted mid-chunk.

Root Cause

The root cause is missing validation on the chunk-size line and unbounded accumulation in add_body_to_buffer/2. Mint treats the server-supplied chunk length as trusted input and buffers all received bytes for that chunk in memory prior to delivery. There is no configurable cap on individual chunk size or on total buffered chunk data.

Attack Vector

Exploitation requires only that a Mint-based client initiate an HTTP/1.x request to an attacker-controlled or attacker-influenced server. Common trigger paths include following redirects, fetching URLs supplied by users, or receiving webhook responses. The attacker responds with Transfer-Encoding: chunked, announces a very large chunk size, and streams bytes at a rate that never completes the chunk. Memory grows in proportion to the bytes sent, culminating in process OOM.

text

       length > byte_size(data) ->
         conn = put_in(conn.buffer, "")
         conn = put_in(conn.request.body, {:chunked, length - byte_size(data)})
-        conn = add_body_to_buffer(conn, data)
+        # Emit the partial chunk data right away instead of buffering it until
+        # the whole chunk arrives. Buffering would let a server that announces a
+        # huge chunk and then dribbles bytes force us to accumulate the entire
+        # (never-completed) chunk in memory (CVE-2026-56810).
+        {conn, responses} = add_body(conn, data, responses)
         {:ok, conn, responses}

       length <= byte_size(data) ->

Source: GitHub commit 193ce71. The patch replaces the buffering call with an immediate emission of the partial chunk data to the caller via add_body/3, eliminating the unbounded accumulation window.

Detection Methods for CVE-2026-56810

Indicators of Compromise

Sustained memory growth in Erlang/Elixir processes that use Mint as an HTTP client, particularly BEAM VM heap growth tied to a single connection process.
Client processes terminating with system_limit or OOM-killer events shortly after initiating outbound HTTP requests.
Long-lived outbound HTTP/1.x connections receiving Transfer-Encoding: chunked responses with abnormally large declared chunk sizes and low byte-arrival rates.

Detection Strategies

Inventory Elixir/Erlang applications and their dependency graphs for mint versions earlier than 1.9.1 using mix deps output or SBOM tooling.
Instrument outbound HTTP client telemetry to record chunk-size declarations and per-connection buffered byte counts, flagging responses with chunk-size lines above a sane threshold.
Correlate BEAM VM memory alerts with the identity of the remote host being fetched to identify servers driving buffer growth.

Monitoring Recommendations

Alert on Elixir/Erlang process memory exceeding baseline thresholds, especially for HTTP client worker pools.
Monitor egress traffic for chunked responses that persist without completion and generate no application-level progress events.
Log and review any process crash reports containing out_of_memory or killed with a Mint call in the stack trace.

How to Mitigate CVE-2026-56810

Immediate Actions Required

Upgrade mint to version 1.9.1 or later across all Elixir/Erlang projects.
Rebuild and redeploy any downstream libraries that vendor or bundle Mint as a transport.
Audit application code that fetches user-supplied URLs, follows redirects, or consumes webhook responses, and restrict outbound destinations where feasible.

Patch Information

The fix is committed in lib/mint/http1.ex in commit 193ce71 and released in mint 1.9.1. See the GitHub Security Advisory GHSA-c59h-fq4p-r36r and the Erlang Ecosystem Foundation CNA advisory for the full disclosure record. Cross-reference tracking is available at OSV EEF-CVE-2026-56810.

Workarounds

Restrict outbound HTTP requests to an allowlist of trusted hosts until upgrade is complete.
Enforce per-process memory limits on HTTP client worker processes so that OOM affects only the offending worker, not the BEAM node.
Apply request timeouts on outbound HTTP calls to break connections that stall while dribbling chunk bytes.

bash

# Upgrade mint in a Mix project
mix deps.update mint

# Verify the resolved version is >= 1.9.1
mix deps | grep mint