CVE-2026-56810: Mint Package Suffers from Denial of Service via Chunked Response Buffering
Summary
CVE-2026-56810: mint buffers an entire chunked response chunk in memory in Mint.HTTP1.decode_body/5. Affects mint across 2 version ranges.
>= 0.5.0, < 1.9.1
>= c575d819d39ebf7e9b77ec24584a5ffbb11c844e, < 193ce714907d16e8adc4ab3c40e4f0c2f045b2a6
Fixed in 1.9.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mint is an HTTP client library for Elixir, designed to provide a simple and efficient way to make HTTP requests. It supports various features such as connection pooling, streaming, and chunked transfer encoding. However, a vulnerability in the Mint.HTTP1 module allows for denial of service through unbounded memory allocation when handling oversized chunked responses.
Vulnerability Detail
The vulnerability arises from the way Mint handles chunked HTTP responses. Specifically, the Mint.HTTP1.decode_body/5 function accumulates data in an unbounded buffer while waiting for the completion of a chunk. If a malicious server sends an excessively large chunk size (e.g., 7FFFFFFF), the client will continue to buffer data indefinitely, leading to potential out-of-memory conditions. This can be exploited by unauthenticated remote servers, especially when clients follow redirects or process user-supplied URLs.
How To Fix
Minimum fixed version
1.9.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement a size limit on the chunked responses you accept. This can be done by wrapping the Mint client calls in a function that checks the size of the incoming data and aborts the request if it exceeds a predefined limit.
Conclusion
CVE-2026-56810 poses a significant risk to applications using the Mint HTTP client due to its handling of chunked responses. It is crucial to update to the patched version 1.9.1 or later to mitigate this vulnerability and ensure the stability of your application.
See every vulnerability recorded for mint →
FAQ
CVE-2026-56810 is a vulnerability in the Mint HTTP client that allows for denial of service due to unbounded memory allocation when processing oversized chunked responses.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
The CVSS score for this vulnerability is 8.7, indicating a high severity level.
If you cannot update immediately, consider implementing a size limit for chunked responses as a temporary workaround to mitigate the risk.
The vulnerability was reported by Peter Ullrich and analyzed by several contributors including Andrea Leopardi and Eric Meadows-Jönsson.
Related vulnerabilities
Recent vulnerabilities recorded for mint.
