CVE-2026-92103: Mint HTTP/2 Client Memory Overflow Vulnerability
Summary
CVE-2026-92103: Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size. Affects mint across 2 version ranges.
>= 0.1.0, < 1.11.0
>= 596ca4304504be68939c4929e0831557097962b8, < 20252ca85065f4d1092aed9ee4ed21841a507dfe
Fixed in 1.11.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mint is an HTTP client library for Elixir that provides support for HTTP/2 and HTTP/1 protocols. It is designed to be lightweight and efficient, enabling developers to build applications that require robust HTTP communication. However, a vulnerability has been identified in Mint's handling of oversized HTTP/2 frames, which can lead to excessive memory consumption.
Vulnerability Detail
The vulnerability arises from the way Mint processes HTTP/2 frames. Specifically, the function Mint.HTTP2.Frame.decode_next/2 only checks the frame size after the entire payload has been received. This allows a malicious HTTP/2 server to send oversized frames, causing the Mint client to buffer up to 16 MiB of data per connection. The lack of limits on the buffer can lead to memory exhaustion, especially for clients maintaining multiple connections to untrusted servers. This issue affects versions of Mint from 0.1.0 up to, but not including, 1.11.0.
How To Fix
Minimum fixed version
1.11.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, connect to untrusted origins using HTTP/1 only. You can do this by specifying the protocols option in your connection call:
Mint.HTTP.connect(:http1, ...)
Conclusion
The CVE-2026-92103 vulnerability in the Mint HTTP client poses a significant risk due to its potential for memory exhaustion through oversized HTTP/2 frames. Users are encouraged to update to the latest version or implement the suggested workarounds to safeguard their applications.
See every vulnerability recorded for mint →
FAQ
CVE-2026-92103 is a vulnerability in the Mint HTTP client that allows a malicious server to exploit oversized HTTP/2 frames, leading to excessive memory consumption.
The vulnerability affects Mint versions from 0.1.0 up to, but not including, 1.11.0.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
The CVSS score for this vulnerability is 6.3, indicating a moderate severity level.
If you cannot update, consider using the workaround of connecting to untrusted origins over HTTP/1 only to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for mint.
