CVE-2026-82729: Elixir Mint HTTP Client DOS Vulnerability

CVE-2026-82729 Overview

CVE-2026-82729 is an algorithmic complexity vulnerability in the elixir-mint mint HTTP client library. The flaw resides in parse_hex_prefix/2 inside lib/mint/http1/parse.ex, which parses the chunk-size field of HTTP/1.1 chunked responses. The parser folds hex digits into an arbitrary-precision integer accumulator without bounding the digit count. A malicious HTTP server can return a chunk-size field with hundreds of thousands of hex digits, forcing quadratic parse work and exhausting client CPU. The issue affects mint from version 1.9.3 before 1.10.0 and is tracked as [CWE-407] Inefficient Algorithmic Complexity.

Critical Impact
A remote HTTP server can dribble a long hex chunk-size out in small TCP segments to force repeated O(N²) reparsing, causing sustained client-side CPU exhaustion and denial of service.

Affected Products

elixir-mint mint version 1.9.3
elixir-mint mint versions after 1.9.3 and before 1.10.0
Elixir and Erlang applications embedding vulnerable mint releases (including transitive users such as Finch, Req, and Tesla.Adapter.Mint)

Discovery Timeline

2026-09-04 - CVE-2026-82729 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-82729

Vulnerability Analysis

The mint HTTP/1 parser processes chunked transfer-encoded response bodies by reading the hex-encoded chunk-size line preceding each chunk. The parse_hex_prefix/2 function accumulates each hex digit using acc * 16 + digit. Because Erlang integers are arbitrary precision, once the accumulator exceeds machine word size each multiplication becomes O(N) in the digit count, making one parse pass O(N²).

The defect is amplified by the surrounding I/O path. handle_data/2 prepends conn.buffer to newly received socket data and re-parses the pending chunk header from the start on every socket message. A server that emits the digits in small TCP segments forces the client to repeat the quadratic work on each delivery, multiplying the effective cost.

According to the advisory, roughly 512,000 hex digits consume more than ten seconds of CPU in a single parse pass at stock defaults. The attack payload passes a valid status line and complete, valid header section first, so upstream intermediaries inspecting only headers observe an ordinary 200 OK response.

Root Cause

The parser imposed no upper bound on the number of hex digits accepted in the chunk-size field. Combined with re-parsing on every socket read, unbounded digit acceptance turned a linear parse into a repeated quadratic operation driven by attacker-controlled packet cadence.

Attack Vector

Exploitation requires the victim to make an HTTP request to an attacker-controlled or attacker-influenced server, or to fetch content through a compromised upstream. The server responds with a well-formed HTTP/1.1 chunked reply whose chunk-size line contains a very large number of leading hex digits, delivered across many small TCP segments. Each segment triggers a full reparse, saturating a scheduler thread on the BEAM VM and degrading or blocking concurrent request processing.

text

// Security patch in lib/mint/http1/parse.ex (bounds chunk-size digits)
 defmodule Mint.HTTP1.Parse do
   @moduledoc false
 
+  # Bound the parse work and keep the chunk size within an unsigned 64-bit value.
+  @max_chunk_size_digits 16
+
   defmacro is_digit(char), do: quote(do: unquote(char) in ?0..?9)
   defmacro is_alpha(char), do: quote(do: unquote(char) in ?a..?z or unquote(char) in ?A..?Z)
   defmacro is_whitespace(char), do: quote(do: unquote(char) in ~c"\s\t")

Source: GitHub Commit bd2a4e7. The fix caps the accepted chunk-size digits at 16, which keeps values within an unsigned 64-bit range and constrains total parse work to constant time.

Detection Methods for CVE-2026-82729

Indicators of Compromise

Outbound HTTP responses containing chunked transfer encoding where the chunk-size line exceeds a handful of hex digits, particularly hundreds or thousands of digits.
BEAM VM processes consuming sustained high CPU while stuck inside Mint.HTTP1.Parse.parse_hex_prefix/2 visible in :observer or recon traces.
HTTP client requests that never complete despite the transport connection remaining open and receiving frequent small TCP segments.

Detection Strategies

Inventory Elixir and Erlang services for the mint dependency and flag any resolved version in the range >= 1.9.3, < 1.10.0, including transitive dependencies pulled in by Finch, Req, Swoosh, or Tesla.
Instrument HTTP clients with per-request wall-clock and CPU-time budgets, alerting when a single response body parse exceeds an expected upper bound.
Use network telemetry to identify HTTP/1.1 chunked responses whose first chunk-size line spans multiple TCP segments before terminating with CRLF.

Monitoring Recommendations

Track scheduler utilization and reductions per process on the BEAM to catch scheduler collapse driven by a single misbehaving HTTP client process.
Log outbound HTTP destinations for services that fetch third-party content and alert on unusual response duration distributions.
Correlate long-running HTTP client processes with the presence of vulnerable mint versions in the deployment manifest.

How to Mitigate CVE-2026-82729

Immediate Actions Required

Upgrade mint to version 1.10.0 or later across all applications and rebuild dependent releases.
Audit mix.lock files and container images for transitive mint versions in 1.9.3–1.9.x and force a resolution to the patched release.
Restrict outbound HTTP traffic from services that use mint to allowlisted destinations where feasible.

Patch Information

The fix is contained in commit bd2a4e7 and shipped in mint1.10.0. It introduces @max_chunk_size_digits 16, which caps the number of accepted hex digits in the chunk-size field. This bounds parse work to constant time and keeps chunk sizes within an unsigned 64-bit range. Additional context is available in the GitHub Security Advisory GHSA-7p8w-j234-7qc8 and the CNA CVE-2026-82729 Record.

Workarounds

Wrap outbound requests in per-request timeouts using Task.async with Task.await/2 so a stalled parse is terminated before it monopolizes a scheduler.
Route outbound HTTP through a forward proxy that validates chunked response framing and rejects abnormally large chunk-size fields.
Where feasible, disable chunked transfer encoding by negotiating HTTP/2 or requesting Connection: close semantics with known-length responses.

bash

# Force the patched mint version in an Elixir project
mix deps.update mint
mix deps.get
mix deps.compile mint

# Verify the resolved version is >= 1.10.0
mix deps | grep mint