CVE-2026-56810 (GCVE-0-2026-56810)
Vulnerability from cvelistv5
Published
2026-07-06 09:17
Modified
2026-07-07 04:32
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Summary
Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint (Mint.HTTP1 module) allows a denial of service via an oversized chunked transfer-encoded response.
This vulnerability is associated with program files lib/mint/http1.ex and program routines 'Elixir.Mint.HTTP1':decode_body/5, 'Elixir.Mint.HTTP1':add_body_to_buffer/2.
When Mint decodes a chunked HTTP response body, it accumulates each partial fragment of the current chunk in the connection's data_buffer (an unbounded iolist) via add_body_to_buffer/2 and does not emit the data to the caller until the full declared chunk length has been received. The chunk size is taken directly from the server and parsed with no upper bound, so a malicious or compromised server can announce one enormous chunk (for example a size line of 7FFFFFFF, about 2 GiB) and then send the body bytes slowly without ever completing the chunk. The client buffers every received byte while it waits for a completion that never arrives, and because no data responses are produced until the chunk finishes, a caller that otherwise streams large content-length bodies safely gains no protection. An unauthenticated remote server (reachable whenever a client follows redirects, fetches user-supplied URLs, or processes webhooks) can drive the client's memory arbitrarily high and trigger an out-of-memory condition.
This issue affects mint: from 0.5.0 before 1.9.1.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| elixir-mint | mint |
Version: 0.5.0 ≤ cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:* |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-56810",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-06T15:52:57.089606Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-06T15:53:00.170Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/elixir-mint/mint/security/advisories/GHSA-c59h-fq4p-r36r"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Mint.HTTP1\u0027"
],
"packageName": "mint",
"packageURL": "pkg:hex/mint",
"product": "mint",
"programFiles": [
"lib/mint/http1.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Mint.HTTP1\u0027:decode_body/5"
},
{
"name": "\u0027Elixir.Mint.HTTP1\u0027:add_body_to_buffer/2"
}
],
"repo": "https://github.com/elixir-mint/mint",
"vendor": "elixir-mint",
"versions": [
{
"lessThan": "1.9.1",
"status": "affected",
"version": "0.5.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Mint.HTTP1\u0027"
],
"packageName": "elixir-mint/mint",
"packageURL": "pkg:github/elixir-mint/mint",
"product": "mint",
"programFiles": [
"lib/mint/http1.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Mint.HTTP1\u0027:decode_body/5"
},
{
"name": "\u0027Elixir.Mint.HTTP1\u0027:add_body_to_buffer/2"
}
],
"repo": "https://github.com/elixir-mint/mint",
"vendor": "elixir-mint",
"versions": [
{
"lessThan": "193ce714907d16e8adc4ab3c40e4f0c2f045b2a6",
"status": "affected",
"version": "c575d819d39ebf7e9b77ec24584a5ffbb11c844e",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.9.1",
"versionStartIncluding": "0.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Andrea Leopardi"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "analyst",
"value": "Eric Meadows-J\u00f6nsson"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAllocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint (\u003ctt\u003eMint.HTTP1\u003c/tt\u003e module) allows a denial of service via an oversized \u003ctt\u003echunked\u003c/tt\u003e transfer-encoded response.\u003c/p\u003e\u003cp\u003eThis vulnerability is associated with program files \u003ctt\u003elib/mint/http1.ex\u003c/tt\u003e and program routines \u003ctt\u003e\u0027Elixir.Mint.HTTP1\u0027:decode_body/5\u003c/tt\u003e, \u003ctt\u003e\u0027Elixir.Mint.HTTP1\u0027:add_body_to_buffer/2\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eWhen Mint decodes a \u003ctt\u003echunked\u003c/tt\u003e HTTP response body, it accumulates each partial fragment of the current chunk in the connection\u0027s \u003ctt\u003edata_buffer\u003c/tt\u003e (an unbounded iolist) via \u003ctt\u003eadd_body_to_buffer/2\u003c/tt\u003e and does not emit the data to the caller until the full declared chunk length has been received. The chunk size is taken directly from the server and parsed with no upper bound, so a malicious or compromised server can announce one enormous chunk (for example a size line of \u003ctt\u003e7FFFFFFF\u003c/tt\u003e, about 2 GiB) and then send the body bytes slowly without ever completing the chunk. The client buffers every received byte while it waits for a completion that never arrives, and because no data responses are produced until the chunk finishes, a caller that otherwise streams large \u003ctt\u003econtent-length\u003c/tt\u003e bodies safely gains no protection. An unauthenticated remote server (reachable whenever a client follows redirects, fetches user-supplied URLs, or processes webhooks) can drive the client\u0027s memory arbitrarily high and trigger an out-of-memory condition.\u003c/p\u003e\u003cp\u003eThis issue affects mint: from 0.5.0 before 1.9.1.\u003c/p\u003e"
}
],
"value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint (Mint.HTTP1 module) allows a denial of service via an oversized chunked transfer-encoded response.\n\nThis vulnerability is associated with program files lib/mint/http1.ex and program routines \u0027Elixir.Mint.HTTP1\u0027:decode_body/5, \u0027Elixir.Mint.HTTP1\u0027:add_body_to_buffer/2.\n\nWhen Mint decodes a chunked HTTP response body, it accumulates each partial fragment of the current chunk in the connection\u0027s data_buffer (an unbounded iolist) via add_body_to_buffer/2 and does not emit the data to the caller until the full declared chunk length has been received. The chunk size is taken directly from the server and parsed with no upper bound, so a malicious or compromised server can announce one enormous chunk (for example a size line of 7FFFFFFF, about 2 GiB) and then send the body bytes slowly without ever completing the chunk. The client buffers every received byte while it waits for a completion that never arrives, and because no data responses are produced until the chunk finishes, a caller that otherwise streams large content-length bodies safely gains no protection. An unauthenticated remote server (reachable whenever a client follows redirects, fetches user-supplied URLs, or processes webhooks) can drive the client\u0027s memory arbitrarily high and trigger an out-of-memory condition.\n\nThis issue affects mint: from 0.5.0 before 1.9.1."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-07T04:32:36.390Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/elixir-mint/mint/security/advisories/GHSA-c59h-fq4p-r36r"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-56810.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-56810"
},
{
"tags": [
"patch"
],
"url": "https://github.com/elixir-mint/mint/commit/193ce714907d16e8adc4ab3c40e4f0c2f045b2a6"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "mint buffers an entire chunked response chunk in memory in Mint.HTTP1.decode_body/5",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-56810",
"datePublished": "2026-07-06T09:17:17.429Z",
"dateReserved": "2026-06-23T12:29:02.507Z",
"dateUpdated": "2026-07-07T04:32:36.390Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-56810\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-06T15:52:57.089606Z\"}}}], \"references\": [{\"url\": \"https://github.com/elixir-mint/mint/security/advisories/GHSA-c59h-fq4p-r36r\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-06T15:52:34.290Z\"}}], \"cna\": {\"title\": \"mint buffers an entire chunked response chunk in memory in Mint.HTTP1.decode_body/5\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Peter Ullrich\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Andrea Leopardi\"}, {\"lang\": \"en\", \"type\": \"analyst\", \"value\": \"Jonatan M\\u00e4nnchen / EEF\"}, {\"lang\": \"en\", \"type\": \"analyst\", \"value\": \"Eric Meadows-J\\u00f6nsson\"}], \"impacts\": [{\"capecId\": \"CAPEC-130\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-130 Excessive Allocation\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 8.7, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/elixir-mint/mint\", \"vendor\": \"elixir-mint\", \"modules\": [\"\u0027Elixir.Mint.HTTP1\u0027\"], \"product\": \"mint\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.5.0\", \"lessThan\": \"1.9.1\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:hex/mint\", \"packageName\": \"mint\", \"programFiles\": [\"lib/mint/http1.ex\"], \"collectionURL\": \"https://repo.hex.pm\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"\u0027Elixir.Mint.HTTP1\u0027:decode_body/5\"}, {\"name\": \"\u0027Elixir.Mint.HTTP1\u0027:add_body_to_buffer/2\"}]}, {\"cpes\": [\"cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/elixir-mint/mint\", \"vendor\": \"elixir-mint\", \"modules\": [\"\u0027Elixir.Mint.HTTP1\u0027\"], \"product\": \"mint\", \"versions\": [{\"status\": \"affected\", \"version\": \"c575d819d39ebf7e9b77ec24584a5ffbb11c844e\", \"lessThan\": \"193ce714907d16e8adc4ab3c40e4f0c2f045b2a6\", \"versionType\": \"git\"}], \"packageURL\": \"pkg:github/elixir-mint/mint\", \"packageName\": \"elixir-mint/mint\", \"programFiles\": [\"lib/mint/http1.ex\"], \"collectionURL\": \"https://github.com\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"\u0027Elixir.Mint.HTTP1\u0027:decode_body/5\"}, {\"name\": \"\u0027Elixir.Mint.HTTP1\u0027:add_body_to_buffer/2\"}]}], \"references\": [{\"url\": \"https://github.com/elixir-mint/mint/security/advisories/GHSA-c59h-fq4p-r36r\", \"tags\": [\"vendor-advisory\", \"related\"]}, {\"url\": \"https://cna.erlef.org/cves/CVE-2026-56810.html\", \"tags\": [\"related\"]}, {\"url\": \"https://osv.dev/vulnerability/EEF-CVE-2026-56810\", \"tags\": [\"related\"]}, {\"url\": \"https://github.com/elixir-mint/mint/commit/193ce714907d16e8adc4ab3c40e4f0c2f045b2a6\", \"tags\": [\"patch\"]}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint (Mint.HTTP1 module) allows a denial of service via an oversized chunked transfer-encoded response.\\n\\nThis vulnerability is associated with program files lib/mint/http1.ex and program routines \u0027Elixir.Mint.HTTP1\u0027:decode_body/5, \u0027Elixir.Mint.HTTP1\u0027:add_body_to_buffer/2.\\n\\nWhen Mint decodes a chunked HTTP response body, it accumulates each partial fragment of the current chunk in the connection\u0027s data_buffer (an unbounded iolist) via add_body_to_buffer/2 and does not emit the data to the caller until the full declared chunk length has been received. The chunk size is taken directly from the server and parsed with no upper bound, so a malicious or compromised server can announce one enormous chunk (for example a size line of 7FFFFFFF, about 2 GiB) and then send the body bytes slowly without ever completing the chunk. The client buffers every received byte while it waits for a completion that never arrives, and because no data responses are produced until the chunk finishes, a caller that otherwise streams large content-length bodies safely gains no protection. An unauthenticated remote server (reachable whenever a client follows redirects, fetches user-supplied URLs, or processes webhooks) can drive the client\u0027s memory arbitrarily high and trigger an out-of-memory condition.\\n\\nThis issue affects mint: from 0.5.0 before 1.9.1.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eAllocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint (\u003ctt\u003eMint.HTTP1\u003c/tt\u003e module) allows a denial of service via an oversized \u003ctt\u003echunked\u003c/tt\u003e transfer-encoded response.\u003c/p\u003e\u003cp\u003eThis vulnerability is associated with program files \u003ctt\u003elib/mint/http1.ex\u003c/tt\u003e and program routines \u003ctt\u003e\u0027Elixir.Mint.HTTP1\u0027:decode_body/5\u003c/tt\u003e, \u003ctt\u003e\u0027Elixir.Mint.HTTP1\u0027:add_body_to_buffer/2\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eWhen Mint decodes a \u003ctt\u003echunked\u003c/tt\u003e HTTP response body, it accumulates each partial fragment of the current chunk in the connection\u0027s \u003ctt\u003edata_buffer\u003c/tt\u003e (an unbounded iolist) via \u003ctt\u003eadd_body_to_buffer/2\u003c/tt\u003e and does not emit the data to the caller until the full declared chunk length has been received. The chunk size is taken directly from the server and parsed with no upper bound, so a malicious or compromised server can announce one enormous chunk (for example a size line of \u003ctt\u003e7FFFFFFF\u003c/tt\u003e, about 2 GiB) and then send the body bytes slowly without ever completing the chunk. The client buffers every received byte while it waits for a completion that never arrives, and because no data responses are produced until the chunk finishes, a caller that otherwise streams large \u003ctt\u003econtent-length\u003c/tt\u003e bodies safely gains no protection. An unauthenticated remote server (reachable whenever a client follows redirects, fetches user-supplied URLs, or processes webhooks) can drive the client\u0027s memory arbitrarily high and trigger an out-of-memory condition.\u003c/p\u003e\u003cp\u003eThis issue affects mint: from 0.5.0 before 1.9.1.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-770\", \"description\": \"CWE-770 Allocation of Resources Without Limits or Throttling\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"1.9.1\", \"versionStartIncluding\": \"0.5.0\"}], \"operator\": \"OR\"}], \"operator\": \"AND\"}], \"providerMetadata\": {\"orgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"shortName\": \"EEF\", \"dateUpdated\": \"2026-07-07T04:32:36.390Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-56810\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-07T04:32:36.390Z\", \"dateReserved\": \"2026-06-23T12:29:02.507Z\", \"assignerOrgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"datePublished\": \"2026-07-06T09:17:17.429Z\", \"assignerShortName\": \"EEF\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…