CVE-2026-82728: Elixir Mint HTTP/1 Parser DOS Vulnerability

CVE-2026-82728 Overview

CVE-2026-82728 is an unbounded resource allocation vulnerability [CWE-770] in the elixir-mint/mint HTTP client library. Two HTTP/1 response-parser states in lib/mint/http1.ex accumulate server bytes without any cap while waiting for a CRLF terminator that a malicious server can withhold indefinitely. A remote HTTP server, or a server reached through an attacker-controlled redirect, can stream data until the BEAM virtual machine is terminated by the operating system out-of-memory (OOM) handler. The flaw affects mint versions from 0.1.0 before 1.10.0.

Critical Impact
A malicious HTTP server can exhaust memory on any Elixir or Erlang client using mint, terminating the BEAM node and causing denial of service across all applications sharing the runtime.

Affected Products

elixir-mint/mint versions 0.1.0 through 1.9.x
Elixir and Erlang applications embedding mint as an HTTP/1 client
Downstream libraries built on mint such as finch and req when running affected versions

Discovery Timeline

2026-09-04 - CVE-2026-82728 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-82728

Vulnerability Analysis

The vulnerability resides in two HTTP/1 response-parser states within lib/mint/http1.ex. The decode_status_line/4 function stores unconsumed data in conn.buffer when the status line is incomplete. The decode_body/5 function performs the same accumulation for an unterminated chunk-extension line. Both paths wait for a CRLF sequence that a hostile server is under no obligation to send.

Because conn.buffer is prepended to every subsequent socket message, each new packet grows the buffer without bound. The existing :max_header_list_size budget was wired only into decode_headers/5 and decode_trailer_headers/4, leaving the status-line and chunk-extension parsing paths uncapped.

The chunk-extension variant is particularly evasive. It triggers only after a valid status line and a complete header section are received, so an intermediary proxy inspecting response headers observes an ordinary HTTP 200 response and forwards the connection without warning.

Root Cause

The root cause is missing enforcement of :max_header_list_size on the status-line and chunk-extension parsing states. Both states treat all received bytes as pending input and buffer them indefinitely while awaiting the CRLF delimiter, violating the resource-throttling principle described in [CWE-770].

Attack Vector

Exploitation requires only that a mint-based client initiate an HTTP/1 request against attacker-controlled infrastructure. This can be achieved through a direct connection, an HTTP redirect to a malicious host, or a server-side fetch of an attacker-supplied URL. The server responds with an incomplete status line, or with valid headers followed by an unterminated chunk-extension line, and streams filler bytes until the client's BEAM node is killed by the OS OOM handler.

The following patch excerpt shows the corrected documentation and new error tuple introduced in the fix:

text

    * `:max_header_list_size` - (positive integer or `:infinity`) the maximum size, in
      **bytes**, of an HTTP/1 response line, header section, or chunked trailer section.
      Defaults to 256 KiB. This option is only used for HTTP/1 connections.
      *Available since 1.9.2*.

    * `{:response_line_too_long, size, max_size}` - when a response status line,
      chunk-size line, or chunk-extension line exceeds the configured size limit.
      `size` is the number of bytes received and `max_size` is the configured maximum.

Source: elixir-mint/mint commit 19be555

Detection Methods for CVE-2026-82728

Indicators of Compromise

Sudden growth in BEAM VM memory usage correlated with outbound HTTP/1 connections from services using mint, finch, or req.
BEAM node crashes with OS-level OOM-killer entries in dmesg or journalctl output.
Long-lived HTTP/1 sockets receiving continuous bytes with no CRLF-terminated status line or chunk header.

Detection Strategies

Inventory application dependencies for mint versions below 1.10.0 using mix deps or mix hex.outdated.
Monitor per-process heap size in Erlang using :erlang.process_info/2 for HTTP client processes to catch abnormal growth before OOM termination.
Inspect network telemetry for outbound HTTP responses where response body or headers exceed reasonable thresholds without progressing to a completed request.

Monitoring Recommendations

Alert on repeated BEAM node restarts or kernel:oom_kill events in host logs.
Track socket-level byte counts on client connections and flag sessions where inbound bytes exceed a configured ceiling without a completed response.
Log all outbound HTTP redirects and validate destination hosts against an allowlist for services performing user-supplied URL fetches.

How to Mitigate CVE-2026-82728

Immediate Actions Required

Upgrade mint to version 1.10.0 or later across all Elixir and Erlang applications.
Update transitive dependencies such as finch, req, and any custom HTTP clients that pin mint versions below 1.10.0.
Audit application code paths that fetch attacker-influenced URLs and restrict outbound HTTP targets where feasible.

Patch Information

The fix is committed in elixir-mint/mint commit 19be555 and documented in the GitHub Security Advisory GHSA-g83f-2j6r-q6m4. The patch extends the :max_header_list_size enforcement to cover the response status line, chunk-size line, and chunk-extension line, returning a {:response_line_too_long, size, max_size} error when limits are exceeded. Additional detail is available in the Erlang Ecosystem Foundation CNA advisory and the OSV report EEF-CVE-2026-82728.

Workarounds

Restrict outbound HTTP/1 connections to a vetted allowlist of hosts to reduce exposure to hostile servers.
Disable or tightly bound HTTP redirect following in application code that consumes user-supplied URLs.
Enforce OS-level memory limits (for example, systemdMemoryMax) on the BEAM process to contain the blast radius until patching is complete.

bash

# Configuration example - upgrade mint in mix.exs and refresh the lock file
# mix.exs
#   defp deps do
#     [
#       {:mint, "~> 1.10"}
#     ]
#   end

mix deps.update mint
mix deps.get
mix deps.compile