CVE-2026-58229: Elixir Mint HTTP Client DOS Vulnerability

CVE-2026-58229 Overview

CVE-2026-58229 is an unbounded resource allocation vulnerability [CWE-770] in the elixir-mint HTTP client library used by Elixir and Erlang applications. The flaw resides in the HTTP/1 response parser, where header and chunked-trailer fields accumulate in a per-request buffer with no size or count cap. A malicious HTTP server can stream header lines indefinitely without sending the terminating blank line, causing the BEAM virtual machine to consume host memory until the operating system's out-of-memory handler terminates the process. The vulnerability affects mint from version 0.1.0 before 1.9.2.

Critical Impact
A remote HTTP server reachable through direct connection, attacker-controlled redirect, Server-Side Request Forgery (SSRF), or Man-in-the-Middle (MITM) positioning can crash any Elixir or Erlang application using Mint as an HTTP client.

Affected Products

elixir-mint/mint versions 0.1.0 through 1.9.1
Elixir and Erlang applications using Mint as an HTTP/1 client
Downstream libraries such as Finch, Req, and Tesla when configured with the Mint adapter

Discovery Timeline

2026-07-14 - CVE-2026-58229 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-58229

Vulnerability Analysis

The defect resides in Mint.HTTP1.decode_headers/5 and Mint.HTTP1.decode_trailer_headers/4 within lib/mint/http1.ex. Both functions parse incoming header data and append each field into request.headers_buffer, a per-request list persisted across TCP segments. The buffer is only cleared once the terminating blank line completes the header section.

Neither function enforces a maximum number of headers nor a cap on total bytes. The underlying Erlang parser :erlang.decode_packet(:httph_bin, binary, []) is invoked with an empty option list, so its per-line and per-packet size limits also default to unlimited. As long as the remote server keeps sending well-formed header lines, Mint keeps appending to the buffer.

Root Cause

The root cause is missing input bounds on an accumulating data structure. The parser trusts that a well-behaved server will terminate the header block, but the HTTP/1 specification does not compel that behavior in a way the client can enforce. Without a :max_header_list_size guard, the buffer grows in direct proportion to server output.

Attack Vector

An attacker delivers a malicious HTTP response to a Mint-based client. The response contains an unbounded stream of syntactically valid header fields, or after a chunked body, an unbounded stream of trailer fields. The blank-line terminator is never sent. Reachability paths include direct outbound requests to attacker-owned hosts, 3xx redirects to attacker-controlled URLs, SSRF against internal services that proxy to attacker infrastructure, and MITM interception on unauthenticated TLS paths. The BEAM node exhausts available memory and is killed by the host OOM killer, taking the entire application offline.

text

     section](#module-logging) in the module documentation. Defaults to `false`.
       *Available since v1.5.0*.
 
+    * `:max_header_list_size` - (positive integer or `:infinity`) the maximum size, in
+      **bytes**, of an HTTP/1 response header section or chunked trailer section. Defaults to
+      256 KiB. This option is only used for HTTP/1 connections. *Available since 1.9.2*.
+
   The following options are HTTP/1-specific and will force the connection
   to be an HTTP/1 connection.

Source: GitHub Commit 566d702e. The patch introduces the :max_header_list_size option, defaulting to 256 KiB, and enforces the cap during header decoding.

Detection Methods for CVE-2026-58229

Indicators of Compromise

BEAM (beam.smp) processes terminated by the Linux OOM killer, visible in dmesg or /var/log/messages
Sudden resident set size (RSS) growth on Elixir or Erlang application hosts tied to outbound HTTP activity
Long-lived outbound TCP sessions to unfamiliar hosts with continuous inbound bytes and no request completion
Application logs showing Mint.HTTPError or connection resets immediately preceding node restart

Detection Strategies

Inventory dependency manifests (mix.lock) across Elixir and Erlang services to flag mint versions below 1.9.2
Monitor per-process memory growth rate for BEAM nodes and alert on sustained increases correlated with HTTP client activity
Instrument outbound HTTP telemetry to record response header count and header section byte size per request
Correlate egress traffic to reputation feeds to surface calls to newly registered or low-reputation destinations

Monitoring Recommendations

Ingest host memory metrics, OOM killer events, and BEAM crash dumps into a centralized data lake for cross-host correlation. The Singularity Data Lake can normalize these signals through OCSF for query at scale.
Enable Singularity Endpoint behavioral telemetry on Linux hosts running Elixir workloads to capture the process-termination chain leading to service outage
Alert when the same remote peer causes repeated Mint client memory pressure across multiple hosts

How to Mitigate CVE-2026-58229

Immediate Actions Required

Upgrade mint to version 1.9.2 or later in every affected application and rebuild release artifacts
Audit transitive dependencies for pinned older Mint versions in libraries such as Finch, Req, Tesla, and Swoosh adapters
Restrict outbound HTTP destinations through egress allowlists where the Mint client contacts a known set of endpoints
Disable or validate URL-based redirect following in application code that consumes untrusted URLs

Patch Information

The fix is delivered in Mint 1.9.2. It introduces the :max_header_list_size option, defaulting to 256 KiB, applied to both response headers and chunked trailer sections. Details are available in the GitHub Security Advisory GHSA-qrfr-wh4c-3qhw and the Erlang Ecosystem Foundation CNA Advisory.

Workarounds

Set a low :max_header_list_size value on new connections when handling untrusted servers after upgrading to 1.9.2
Place a reverse proxy or forward proxy that enforces header size limits between Mint clients and untrusted upstreams
Constrain BEAM node memory with cgroup limits so a single crashing process cannot exhaust host memory shared with other services
Disable HTTP/1 fallback where HTTP/2 is available and sufficient for the workload

bash

# Update mix.exs to require the patched release
# {:mint, "~> 1.9.2"}
mix deps.update mint
mix deps.get

# Verify the resolved version
mix deps | grep mint