CVE-2026-91043: Mint HTTP/2 Package Memory Exhaustion Vulnerability
Summary
CVE-2026-91043: Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to exhaust memory on the client host and cause a denial of service. Affects mint across 2 version ranges.
>= 1.1.0, < 1.11.0
>= 8e0e04680476f90f9f68db4dfeabcbe66dabfc4d, < c7895cb022196c77ec35570c8e873a84393ff4b8
Fixed in 1.11.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mint is an HTTP client library for Elixir, designed to provide a simple and efficient way to handle HTTP requests and responses. It supports HTTP/2, which allows for multiplexing multiple requests over a single connection, improving performance. However, a vulnerability exists in the way Mint handles HTTP/2 responses, specifically related to cookie fields, which can lead to severe memory exhaustion on the client side.
Vulnerability Detail
The vulnerability arises from the way Mint enforces the max_header_list_size setting only on the compressed size of inbound header blocks, rather than the decoded size. This discrepancy allows a malicious HTTP/2 server to send a header block that, while appearing to comply with the size limit, can cause the client to allocate excessive memory when decoding cookie values. The result is a denial of service, as the client can exhaust its memory resources, potentially crashing the application or the entire virtual machine.
How To Fix
Minimum fixed version
1.11.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can lower the max_header_list_size setting in your Mint client configuration. For example, you can set it to 4096 bytes as follows:
client_settings = [max_header_list_size: 4096] Mint.HTTP.connect(:http2, host, port, client_settings)
This adjustment limits the size of responses and helps mitigate the risk of memory exhaustion.
Conclusion
CVE-2026-91043 is a significant vulnerability in the Mint HTTP/2 client that can lead to memory exhaustion and denial of service. It is crucial for developers using this library to update to the patched version or implement workarounds to mitigate the risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for mint →
FAQ
CVE-2026-91043 is a vulnerability in the Mint HTTP/2 client that allows a malicious server to exhaust client memory through improperly sized HTTP/2 responses.
If your application uses the Mint HTTP/2 client, it may be susceptible to memory exhaustion attacks, leading to potential crashes or denial of service.
The vulnerability affects Mint versions from 1.1.0 up to, but not including, 1.11.0.
You can use Vulert, a monitoring tool that checks for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
The CVSS score for CVE-2026-91043 is 8.2, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for mint.
