← Back to CVE Explorer

CVE-2026-56810

Full vulnerability record from the local CVENow database.

Description

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint (Mint.HTTP1 module) allows a denial of service via an oversized chunked transfer-encoded response. This vulnerability is associated with program files lib/mint/http1.ex and program routines 'Elixir.Mint.HTTP1':decode_body/5, 'Elixir.Mint.HTTP1':add_body_to_buffer/2. When Mint decodes a chunked HTTP response body, it accumulates each partial fragment of the current chunk in the connection's data_buffer (an unbounded iolist) via add_body_to_buffer/2 and does not emit the data to the caller until the full declared chunk length has been received. The chunk size is taken directly from the server and parsed with no upper bound, so a malicious or compromised server can announce one enormous chunk (for example a size line of 7FFFFFFF, about 2 GiB) and then send the body bytes slowly without ever completing the chunk. The client buffers every received byte while it waits for a completion that never arrives, and because no data responses are produced until the chunk finishes, a caller that otherwise streams large content-length bodies safely gains no protection. An unauthenticated remote server (reachable whenever a client follows redirects, fetches user-supplied URLs, or processes webhooks) can drive the client's memory arbitrarily high and trigger an out-of-memory condition. This issue affects mint: from 0.5.0 before 1.9.1.

Severity
HIGH
CVSS score
8.7 (v4.0)
Vulnerability status
Deferred
Source identifier
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Published
2026-07-06 11:16:30.983000
Last modified
2026-10-25 15:10:00.147000
View original CVE JSON 
{
  "id": "CVE-2026-56810",
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "published": "2026-07-06T11:16:30.983",
  "lastModified": "2026-10-25T15:10:00.147",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint (Mint.HTTP1 module) allows a denial of service via an oversized chunked transfer-encoded response.\n\nThis vulnerability is associated with program files lib/mint/http1.ex and program routines 'Elixir.Mint.HTTP1':decode_body/5, 'Elixir.Mint.HTTP1':add_body_to_buffer/2.\n\nWhen Mint decodes a chunked HTTP response body, it accumulates each partial fragment of the current chunk in the connection's data_buffer (an unbounded iolist) via add_body_to_buffer/2 and does not emit the data to the caller until the full declared chunk length has been received. The chunk size is taken directly from the server and parsed with no upper bound, so a malicious or compromised server can announce one enormous chunk (for example a size line of 7FFFFFFF, about 2 GiB) and then send the body bytes slowly without ever completing the chunk. The client buffers every received byte while it waits for a completion that never arrives, and because no data responses are produced until the chunk finishes, a caller that otherwise streams large content-length bodies safely gains no protection. An unauthenticated remote server (reachable whenever a client follows redirects, fetches user-supplied URLs, or processes webhooks) can drive the client's memory arbitrarily high and trigger an out-of-memory condition.\n\nThis issue affects mint: from 0.5.0 before 1.9.1."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de asignación de recursos sin límites o estrangulamiento en elixir-mint mint (módulo Mint.HTTP1) permite una denegación de servicio a través de una respuesta codificada por transferencia fragmentada de tamaño excesivo.\n\nEsta vulnerabilidad está asociada con los archivos de programa lib/mint/http1.ex y las rutinas de programa ’Elixir.Mint.HTTP1’:decode_body/5, ’Elixir.Mint.HTTP1’:add_body_to_buffer/2.\n\nCuando Mint decodifica un cuerpo de respuesta HTTP fragmentado, acumula cada fragmento parcial del fragmento actual en el data_buffer de la conexión (una iolist ilimitada) a través de add_body_to_buffer/2 y no emite los datos al llamador hasta que se haya recibido la longitud completa declarada del fragmento. El tamaño del fragmento se toma directamente del servidor y se analiza sin límite superior, por lo que un servidor malicioso o comprometido puede anunciar un fragmento enorme (por ejemplo, una línea de tamaño de 7FFFFFFF, aproximadamente 2 GiB) y luego enviar los bytes del cuerpo lentamente sin completar nunca el fragmento. El cliente almacena en búfer cada byte recibido mientras espera una finalización que nunca llega, y debido a que no se producen respuestas de datos hasta que el fragmento termina, un llamador que de otro modo transmite cuerpos grandes con longitud de contenido de forma segura no obtiene ninguna protección. Un servidor remoto no autenticado (accesible siempre que un cliente sigue redirecciones, obtiene URL proporcionadas por el usuario o procesa webhooks) puede elevar la memoria del cliente arbitrariamente y desencadenar una condición de falta de memoria.\n\nEste problema afecta a mint: desde 0.5.0 antes de 1.9.1."
    }
  ],
  "affected": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "affectedData": [
        {
          "vendor": "elixir-mint",
          "product": "mint",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.hex.pm",
          "packageName": "mint",
          "cpes": [
            "cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "'Elixir.Mint.HTTP1'"
          ],
          "programFiles": [
            "lib/mint/http1.ex"
          ],
          "programRoutines": [
            {
              "name": "'Elixir.Mint.HTTP1':decode_body/5"
            },
            {
              "name": "'Elixir.Mint.HTTP1':add_body_to_buffer/2"
            }
          ],
          "repo": "https://github.com/elixir-mint/mint",
          "packageURL": "pkg:hex/mint",
          "versions": [
            {
              "version": "0.5.0",
              "lessThan": "1.9.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "elixir-mint",
          "product": "mint",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com",
          "packageName": "elixir-mint/mint",
          "cpes": [
            "cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "'Elixir.Mint.HTTP1'"
          ],
          "programFiles": [
            "lib/mint/http1.ex"
          ],
          "programRoutines": [
            {
              "name": "'Elixir.Mint.HTTP1':decode_body/5"
            },
            {
              "name": "'Elixir.Mint.HTTP1':add_body_to_buffer/2"
            }
          ],
          "repo": "https://github.com/elixir-mint/mint",
          "packageURL": "pkg:github/elixir-mint/mint",
          "versions": [
            {
              "version": "c575d819d39ebf7e9b77ec24584a5ffbb11c844e",
              "lessThan": "193ce714907d16e8adc4ab3c40e4f0c2f045b2a6",
              "versionType": "git",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-06T15:52:57.089606Z",
          "id": "CVE-2026-56810",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://cna.erlef.org/cves/CVE-2026-56810.html",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/elixir-mint/mint/commit/193ce714907d16e8adc4ab3c40e4f0c2f045b2a6",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/elixir-mint/mint/security/advisories/GHSA-c59h-fq4p-r36r",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-56810",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/elixir-mint/mint/security/advisories/GHSA-c59h-fq4p-r36r",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}