Vulnerability-Lookup

CVE-2026-48862 (GCVE-0-2026-48862)

Vulnerability from cvelistv5 – Published: 2026-06-02 14:15 – Updated: 2026-06-02 19:14

Title

Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrency

Summary

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint Mint allows attacker-controlled HTTP/2 servers to exhaust memory in a Mint client via PUSH_PROMISE flooding. In lib/mint/http2.ex, Mint.HTTP2.decode_push_promise_headers_and_add_response/5 inserts a :reserved_remote entry into conn.streams for every promised stream ID. The neighbouring Mint.HTTP2.assert_valid_promised_stream_id/2 only verifies that the promised ID is even and not already present; client_settings.max_concurrent_streams is not consulted at promise time. The concurrency cap is only checked when the response HEADERS for the promised stream arrive, so a server that emits PUSH_PROMISE frames and withholds the matching HEADERS never trips that check. HTTP/2 server push is accepted by default (client_settings.enable_push defaults to true). A single long-lived HTTP/2 connection to a hostile server lets that server pin one conn.streams entry per PUSH_PROMISE frame it sends, with no upper bound, until the client process runs out of memory. This issue affects mint: from 0.2.0 before 1.9.0.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

EEF

References

4 references

URL	Tags
https://github.com/elixir-mint/mint/security/advi…	vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-48862.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-48862	related
https://github.com/elixir-mint/mint/commit/70b97b…	patch

Impacted products

2 products

Vendor	Product	Version
elixir-mint	mint	Affected: 0.2.0 , < 1.9.0 (semver) cpe:2.3:a:elixir-mint:mint::::::::
elixir-mint	mint	Affected: 65c6394d05a1b8aa4a7461708c3aa173e8d7a5cf , < 70b97b6a5209fb288b0e04d8e657dda26c59de67 (git) cpe:2.3:a:elixir-mint:mint::::::::

Credits

Peter Ullrich Eric Meadows-Jönsson Jonatan Männchen / EEF

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48862",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-02T18:11:00.524487Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-02T18:11:05.599Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/elixir-mint/mint/security/advisories/GHSA-g586-ccqf-7x4r"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Mint.HTTP2\u0027"
          ],
          "packageName": "mint",
          "packageURL": "pkg:hex/mint",
          "product": "mint",
          "programFiles": [
            "lib/mint/http2.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Mint.HTTP2\u0027:handle_push_promise/3"
            },
            {
              "name": "\u0027Elixir.Mint.HTTP2\u0027:decode_push_promise_headers_and_add_response/5"
            }
          ],
          "repo": "https://github.com/elixir-mint/mint",
          "vendor": "elixir-mint",
          "versions": [
            {
              "lessThan": "1.9.0",
              "status": "affected",
              "version": "0.2.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Mint.HTTP2\u0027"
          ],
          "packageName": "elixir-mint/mint",
          "packageURL": "pkg:github/elixir-mint/mint",
          "product": "mint",
          "programFiles": [
            "lib/mint/http2.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Mint.HTTP2\u0027:handle_push_promise/3"
            },
            {
              "name": "\u0027Elixir.Mint.HTTP2\u0027:decode_push_promise_headers_and_add_response/5"
            }
          ],
          "repo": "https://github.com/elixir-mint/mint.git",
          "vendor": "elixir-mint",
          "versions": [
            {
              "lessThan": "70b97b6a5209fb288b0e04d8e657dda26c59de67",
              "status": "affected",
              "version": "65c6394d05a1b8aa4a7461708c3aa173e8d7a5cf",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.9.0",
                  "versionStartIncluding": "0.2.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Eric Meadows-J\u00f6nsson"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint Mint allows attacker-controlled HTTP/2 servers to exhaust memory in a Mint client via PUSH_PROMISE flooding.\u003cp\u003eIn \u003ctt\u003elib/mint/http2.ex\u003c/tt\u003e, \u003ctt\u003e\u0027Elixir.Mint.HTTP2\u0027:decode_push_promise_headers_and_add_response/5\u003c/tt\u003e inserts a \u003ctt\u003e:reserved_remote\u003c/tt\u003e entry into \u003ctt\u003econn.streams\u003c/tt\u003e for every promised stream ID. The neighbouring \u003ctt\u003e\u0027Elixir.Mint.HTTP2\u0027:assert_valid_promised_stream_id/2\u003c/tt\u003e only verifies that the promised ID is even and not already present; \u003ctt\u003eclient_settings.max_concurrent_streams\u003c/tt\u003e is not consulted at promise time. The concurrency cap is only checked when the response \u003ctt\u003eHEADERS\u003c/tt\u003e for the promised stream arrive, so a server that emits \u003ctt\u003ePUSH_PROMISE\u003c/tt\u003e frames and withholds the matching \u003ctt\u003eHEADERS\u003c/tt\u003e never trips that check.\u003c/p\u003e\u003cp\u003eHTTP/2 server push is accepted by default (\u003ctt\u003eclient_settings.enable_push\u003c/tt\u003e defaults to \u003ctt\u003etrue\u003c/tt\u003e). A single long-lived HTTP/2 connection to a hostile server lets that server pin one \u003ctt\u003econn.streams\u003c/tt\u003e entry per \u003ctt\u003ePUSH_PROMISE\u003c/tt\u003e frame it sends, with no upper bound, until the client process runs out of memory.\u003c/p\u003e\u003cp\u003eThis issue affects mint: from 0.2.0 before 1.9.0.\u003c/p\u003e"
            }
          ],
          "value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint Mint allows attacker-controlled HTTP/2 servers to exhaust memory in a Mint client via PUSH_PROMISE flooding.\n\nIn lib/mint/http2.ex, Mint.HTTP2.decode_push_promise_headers_and_add_response/5 inserts a :reserved_remote entry into conn.streams for every promised stream ID. The neighbouring Mint.HTTP2.assert_valid_promised_stream_id/2 only verifies that the promised ID is even and not already present; client_settings.max_concurrent_streams is not consulted at promise time. The concurrency cap is only checked when the response HEADERS for the promised stream arrive, so a server that emits PUSH_PROMISE frames and withholds the matching HEADERS never trips that check.\n\nHTTP/2 server push is accepted by default (client_settings.enable_push defaults to true). A single long-lived HTTP/2 connection to a hostile server lets that server pin one conn.streams entry per PUSH_PROMISE frame it sends, with no upper bound, until the client process runs out of memory.\n\nThis issue affects mint: from 0.2.0 before 1.9.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-130",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-130 Excessive Allocation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-02T19:14:09.683Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/elixir-mint/mint/security/advisories/GHSA-g586-ccqf-7x4r"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-48862.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48862"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/elixir-mint/mint/commit/70b97b6a5209fb288b0e04d8e657dda26c59de67"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrency",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eDisable HTTP/2 server push on connections to untrusted servers by passing \u003ctt\u003eclient_settings: [enable_push: false]\u003c/tt\u003e to \u003ctt\u003e\u0027Elixir.Mint.HTTP\u0027:connect/4\u003c/tt\u003e. This makes Mint reject any inbound \u003ctt\u003ePUSH_PROMISE\u003c/tt\u003e frame with a \u003ctt\u003ePROTOCOL_ERROR\u003c/tt\u003e before the vulnerable code path is reached.\u003c/p\u003e"
            }
          ],
          "value": "Disable HTTP/2 server push on connections to untrusted servers by passing client_settings: [enable_push: false] to Mint.HTTP.connect/4. This makes Mint reject any inbound PUSH_PROMISE frame with a PROTOCOL_ERROR before the vulnerable code path is reached."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-48862",
    "datePublished": "2026-06-02T14:15:10.591Z",
    "dateReserved": "2026-05-25T20:44:10.697Z",
    "dateUpdated": "2026-06-02T19:14:09.683Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-48862",
      "date": "2026-08-05",
      "epss": "0.00384",
      "percentile": "0.31081"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-48862\",\"sourceIdentifier\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"published\":\"2026-06-02T16:16:44.627\",\"lastModified\":\"2026-07-22T19:10:00.120\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint Mint allows attacker-controlled HTTP/2 servers to exhaust memory in a Mint client via PUSH_PROMISE flooding.\\n\\nIn lib/mint/http2.ex, Mint.HTTP2.decode_push_promise_headers_and_add_response/5 inserts a :reserved_remote entry into conn.streams for every promised stream ID. The neighbouring Mint.HTTP2.assert_valid_promised_stream_id/2 only verifies that the promised ID is even and not already present; client_settings.max_concurrent_streams is not consulted at promise time. The concurrency cap is only checked when the response HEADERS for the promised stream arrive, so a server that emits PUSH_PROMISE frames and withholds the matching HEADERS never trips that check.\\n\\nHTTP/2 server push is accepted by default (client_settings.enable_push defaults to true). A single long-lived HTTP/2 connection to a hostile server lets that server pin one conn.streams entry per PUSH_PROMISE frame it sends, with no upper bound, until the client process runs out of memory.\\n\\nThis issue affects mint: from 0.2.0 before 1.9.0.\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de asignaci\u00f3n de recursos sin l\u00edmites ni limitaci\u00f3n en elixir-mint Mint permite a servidores HTTP/2 controlados por atacantes agotar la memoria en un cliente Mint mediante inundaci\u00f3n de PUSH_PROMISE.\\n\\nEn lib/mint/http2.ex, Mint.HTTP2.decode_push_promise_headers_and_add_response/5 inserta una entrada :reserved_remote en conn.streams para cada ID de flujo prometido. La funci\u00f3n adyacente Mint.HTTP2.assert_valid_promised_stream_id/2 solo verifica que el ID prometido sea par y no est\u00e9 ya presente; client_settings.max_concurrent_streams no se consulta en el momento de la promesa. El l\u00edmite de concurrencia solo se verifica cuando llegan los HEADERS de respuesta para el flujo prometido, por lo que un servidor que emite tramas PUSH_PROMISE y retiene los HEADERS coincidentes nunca activa esa verificaci\u00f3n.\\n\\nEl env\u00edo de servidor HTTP/2 se acepta por defecto (client_settings.enable_push por defecto es true). Una \u00fanica conexi\u00f3n HTTP/2 de larga duraci\u00f3n a un servidor hostil permite a ese servidor fijar una entrada conn.streams por cada trama PUSH_PROMISE que env\u00eda, sin l\u00edmite superior, hasta que el proceso del cliente se quede sin memoria.\\n\\nEste problema afecta a mint: desde 0.2.0 antes de 1.9.0.\"}],\"affected\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"affectedData\":[{\"vendor\":\"elixir-mint\",\"product\":\"mint\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://repo.hex.pm\",\"packageName\":\"mint\",\"cpes\":[\"cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*\"],\"modules\":[\"\u0027Elixir.Mint.HTTP2\u0027\"],\"programFiles\":[\"lib/mint/http2.ex\"],\"programRoutines\":[{\"name\":\"\u0027Elixir.Mint.HTTP2\u0027:handle_push_promise/3\"},{\"name\":\"\u0027Elixir.Mint.HTTP2\u0027:decode_push_promise_headers_and_add_response/5\"}],\"repo\":\"https://github.com/elixir-mint/mint\",\"packageURL\":\"pkg:hex/mint\",\"versions\":[{\"version\":\"0.2.0\",\"lessThan\":\"1.9.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"elixir-mint\",\"product\":\"mint\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://github.com\",\"packageName\":\"elixir-mint/mint\",\"cpes\":[\"cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*\"],\"modules\":[\"\u0027Elixir.Mint.HTTP2\u0027\"],\"programFiles\":[\"lib/mint/http2.ex\"],\"programRoutines\":[{\"name\":\"\u0027Elixir.Mint.HTTP2\u0027:handle_push_promise/3\"},{\"name\":\"\u0027Elixir.Mint.HTTP2\u0027:decode_push_promise_headers_and_add_response/5\"}],\"repo\":\"https://github.com/elixir-mint/mint.git\",\"packageURL\":\"pkg:github/elixir-mint/mint\",\"versions\":[{\"version\":\"65c6394d05a1b8aa4a7461708c3aa173e8d7a5cf\",\"lessThan\":\"70b97b6a5209fb288b0e04d8e657dda26c59de67\",\"versionType\":\"git\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-02T18:11:00.524487Z\",\"id\":\"CVE-2026-48862\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-770\"}]}],\"references\":[{\"url\":\"https://cna.erlef.org/cves/CVE-2026-48862.html\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/elixir-mint/mint/commit/70b97b6a5209fb288b0e04d8e657dda26c59de67\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/elixir-mint/mint/security/advisories/GHSA-g586-ccqf-7x4r\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://osv.dev/vulnerability/EEF-CVE-2026-48862\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/elixir-mint/mint/security/advisories/GHSA-g586-ccqf-7x4r\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "redhat_vex": {
      "current_release_date": "2026-06-05T19:12:59+00:00",
      "cve": "CVE-2026-48862",
      "id": "CVE-2026-48862",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrency",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48862.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-48862\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-02T18:11:00.524487Z\"}}}], \"references\": [{\"url\": \"https://github.com/elixir-mint/mint/security/advisories/GHSA-g586-ccqf-7x4r\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-02T18:10:50.687Z\"}}], \"cna\": {\"title\": \"Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrency\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Peter Ullrich\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Eric Meadows-J\\u00f6nsson\"}, {\"lang\": \"en\", \"type\": \"analyst\", \"value\": \"Jonatan M\\u00e4nnchen / EEF\"}], \"impacts\": [{\"capecId\": \"CAPEC-130\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-130 Excessive Allocation\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 8.2, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/elixir-mint/mint\", \"vendor\": \"elixir-mint\", \"modules\": [\"\u0027Elixir.Mint.HTTP2\u0027\"], \"product\": \"mint\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.2.0\", \"lessThan\": \"1.9.0\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:hex/mint\", \"packageName\": \"mint\", \"programFiles\": [\"lib/mint/http2.ex\"], \"collectionURL\": \"https://repo.hex.pm\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"\u0027Elixir.Mint.HTTP2\u0027:handle_push_promise/3\"}, {\"name\": \"\u0027Elixir.Mint.HTTP2\u0027:decode_push_promise_headers_and_add_response/5\"}]}, {\"cpes\": [\"cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/elixir-mint/mint.git\", \"vendor\": \"elixir-mint\", \"modules\": [\"\u0027Elixir.Mint.HTTP2\u0027\"], \"product\": \"mint\", \"versions\": [{\"status\": \"affected\", \"version\": \"65c6394d05a1b8aa4a7461708c3aa173e8d7a5cf\", \"lessThan\": \"70b97b6a5209fb288b0e04d8e657dda26c59de67\", \"versionType\": \"git\"}], \"packageURL\": \"pkg:github/elixir-mint/mint\", \"packageName\": \"elixir-mint/mint\", \"programFiles\": [\"lib/mint/http2.ex\"], \"collectionURL\": \"https://github.com\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"\u0027Elixir.Mint.HTTP2\u0027:handle_push_promise/3\"}, {\"name\": \"\u0027Elixir.Mint.HTTP2\u0027:decode_push_promise_headers_and_add_response/5\"}]}], \"references\": [{\"url\": \"https://github.com/elixir-mint/mint/security/advisories/GHSA-g586-ccqf-7x4r\", \"tags\": [\"vendor-advisory\", \"related\"]}, {\"url\": \"https://cna.erlef.org/cves/CVE-2026-48862.html\", \"tags\": [\"related\"]}, {\"url\": \"https://osv.dev/vulnerability/EEF-CVE-2026-48862\", \"tags\": [\"related\"]}, {\"url\": \"https://github.com/elixir-mint/mint/commit/70b97b6a5209fb288b0e04d8e657dda26c59de67\", \"tags\": [\"patch\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Disable HTTP/2 server push on connections to untrusted servers by passing client_settings: [enable_push: false] to Mint.HTTP.connect/4. This makes Mint reject any inbound PUSH_PROMISE frame with a PROTOCOL_ERROR before the vulnerable code path is reached.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eDisable HTTP/2 server push on connections to untrusted servers by passing \u003ctt\u003eclient_settings: [enable_push: false]\u003c/tt\u003e to \u003ctt\u003e\u0027Elixir.Mint.HTTP\u0027:connect/4\u003c/tt\u003e. This makes Mint reject any inbound \u003ctt\u003ePUSH_PROMISE\u003c/tt\u003e frame with a \u003ctt\u003ePROTOCOL_ERROR\u003c/tt\u003e before the vulnerable code path is reached.\u003c/p\u003e\", \"base64\": false}]}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint Mint allows attacker-controlled HTTP/2 servers to exhaust memory in a Mint client via PUSH_PROMISE flooding.\\n\\nIn lib/mint/http2.ex, Mint.HTTP2.decode_push_promise_headers_and_add_response/5 inserts a :reserved_remote entry into conn.streams for every promised stream ID. The neighbouring Mint.HTTP2.assert_valid_promised_stream_id/2 only verifies that the promised ID is even and not already present; client_settings.max_concurrent_streams is not consulted at promise time. The concurrency cap is only checked when the response HEADERS for the promised stream arrive, so a server that emits PUSH_PROMISE frames and withholds the matching HEADERS never trips that check.\\n\\nHTTP/2 server push is accepted by default (client_settings.enable_push defaults to true). A single long-lived HTTP/2 connection to a hostile server lets that server pin one conn.streams entry per PUSH_PROMISE frame it sends, with no upper bound, until the client process runs out of memory.\\n\\nThis issue affects mint: from 0.2.0 before 1.9.0.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint Mint allows attacker-controlled HTTP/2 servers to exhaust memory in a Mint client via PUSH_PROMISE flooding.\u003cp\u003eIn \u003ctt\u003elib/mint/http2.ex\u003c/tt\u003e, \u003ctt\u003e\u0027Elixir.Mint.HTTP2\u0027:decode_push_promise_headers_and_add_response/5\u003c/tt\u003e inserts a \u003ctt\u003e:reserved_remote\u003c/tt\u003e entry into \u003ctt\u003econn.streams\u003c/tt\u003e for every promised stream ID. The neighbouring \u003ctt\u003e\u0027Elixir.Mint.HTTP2\u0027:assert_valid_promised_stream_id/2\u003c/tt\u003e only verifies that the promised ID is even and not already present; \u003ctt\u003eclient_settings.max_concurrent_streams\u003c/tt\u003e is not consulted at promise time. The concurrency cap is only checked when the response \u003ctt\u003eHEADERS\u003c/tt\u003e for the promised stream arrive, so a server that emits \u003ctt\u003ePUSH_PROMISE\u003c/tt\u003e frames and withholds the matching \u003ctt\u003eHEADERS\u003c/tt\u003e never trips that check.\u003c/p\u003e\u003cp\u003eHTTP/2 server push is accepted by default (\u003ctt\u003eclient_settings.enable_push\u003c/tt\u003e defaults to \u003ctt\u003etrue\u003c/tt\u003e). A single long-lived HTTP/2 connection to a hostile server lets that server pin one \u003ctt\u003econn.streams\u003c/tt\u003e entry per \u003ctt\u003ePUSH_PROMISE\u003c/tt\u003e frame it sends, with no upper bound, until the client process runs out of memory.\u003c/p\u003e\u003cp\u003eThis issue affects mint: from 0.2.0 before 1.9.0.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-770\", \"description\": \"CWE-770 Allocation of Resources Without Limits or Throttling\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"1.9.0\", \"versionStartIncluding\": \"0.2.0\"}], \"operator\": \"OR\"}], \"operator\": \"AND\"}], \"providerMetadata\": {\"orgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"shortName\": \"EEF\", \"dateUpdated\": \"2026-06-02T19:14:09.683Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-48862\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-02T19:14:09.683Z\", \"dateReserved\": \"2026-05-25T20:44:10.697Z\", \"assignerOrgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"datePublished\": \"2026-06-02T14:15:10.591Z\", \"assignerShortName\": \"EEF\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-48862

Vulnerability from fkie_nvd - Published: 2026-06-02 16:16 - Updated: 2026-07-22 19:10

Severity

8.2 (High) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://cna.erlef.org/cves/CVE-2026-48862.html
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/elixir-mint/mint/commit/70b97b6a5209fb288b0e04d8e657dda26c59de67
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/elixir-mint/mint/security/advisories/GHSA-g586-ccqf-7x4r
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://osv.dev/vulnerability/EEF-CVE-2026-48862
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/elixir-mint/mint/security/advisories/GHSA-g586-ccqf-7x4r

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Mint.HTTP2\u0027"
          ],
          "packageName": "mint",
          "packageURL": "pkg:hex/mint",
          "product": "mint",
          "programFiles": [
            "lib/mint/http2.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Mint.HTTP2\u0027:handle_push_promise/3"
            },
            {
              "name": "\u0027Elixir.Mint.HTTP2\u0027:decode_push_promise_headers_and_add_response/5"
            }
          ],
          "repo": "https://github.com/elixir-mint/mint",
          "vendor": "elixir-mint",
          "versions": [
            {
              "lessThan": "1.9.0",
              "status": "affected",
              "version": "0.2.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Mint.HTTP2\u0027"
          ],
          "packageName": "elixir-mint/mint",
          "packageURL": "pkg:github/elixir-mint/mint",
          "product": "mint",
          "programFiles": [
            "lib/mint/http2.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Mint.HTTP2\u0027:handle_push_promise/3"
            },
            {
              "name": "\u0027Elixir.Mint.HTTP2\u0027:decode_push_promise_headers_and_add_response/5"
            }
          ],
          "repo": "https://github.com/elixir-mint/mint.git",
          "vendor": "elixir-mint",
          "versions": [
            {
              "lessThan": "70b97b6a5209fb288b0e04d8e657dda26c59de67",
              "status": "affected",
              "version": "65c6394d05a1b8aa4a7461708c3aa173e8d7a5cf",
              "versionType": "git"
            }
          ]
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint Mint allows attacker-controlled HTTP/2 servers to exhaust memory in a Mint client via PUSH_PROMISE flooding.\n\nIn lib/mint/http2.ex, Mint.HTTP2.decode_push_promise_headers_and_add_response/5 inserts a :reserved_remote entry into conn.streams for every promised stream ID. The neighbouring Mint.HTTP2.assert_valid_promised_stream_id/2 only verifies that the promised ID is even and not already present; client_settings.max_concurrent_streams is not consulted at promise time. The concurrency cap is only checked when the response HEADERS for the promised stream arrive, so a server that emits PUSH_PROMISE frames and withholds the matching HEADERS never trips that check.\n\nHTTP/2 server push is accepted by default (client_settings.enable_push defaults to true). A single long-lived HTTP/2 connection to a hostile server lets that server pin one conn.streams entry per PUSH_PROMISE frame it sends, with no upper bound, until the client process runs out of memory.\n\nThis issue affects mint: from 0.2.0 before 1.9.0."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de asignaci\u00f3n de recursos sin l\u00edmites ni limitaci\u00f3n en elixir-mint Mint permite a servidores HTTP/2 controlados por atacantes agotar la memoria en un cliente Mint mediante inundaci\u00f3n de PUSH_PROMISE.\n\nEn lib/mint/http2.ex, Mint.HTTP2.decode_push_promise_headers_and_add_response/5 inserta una entrada :reserved_remote en conn.streams para cada ID de flujo prometido. La funci\u00f3n adyacente Mint.HTTP2.assert_valid_promised_stream_id/2 solo verifica que el ID prometido sea par y no est\u00e9 ya presente; client_settings.max_concurrent_streams no se consulta en el momento de la promesa. El l\u00edmite de concurrencia solo se verifica cuando llegan los HEADERS de respuesta para el flujo prometido, por lo que un servidor que emite tramas PUSH_PROMISE y retiene los HEADERS coincidentes nunca activa esa verificaci\u00f3n.\n\nEl env\u00edo de servidor HTTP/2 se acepta por defecto (client_settings.enable_push por defecto es true). Una \u00fanica conexi\u00f3n HTTP/2 de larga duraci\u00f3n a un servidor hostil permite a ese servidor fijar una entrada conn.streams por cada trama PUSH_PROMISE que env\u00eda, sin l\u00edmite superior, hasta que el proceso del cliente se quede sin memoria.\n\nEste problema afecta a mint: desde 0.2.0 antes de 1.9.0."
    }
  ],
  "id": "CVE-2026-48862",
  "lastModified": "2026-07-22T19:10:00.120",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-48862",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-02T18:11:00.524487Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-02T16:16:44.627",
  "references": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://cna.erlef.org/cves/CVE-2026-48862.html"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/elixir-mint/mint/commit/70b97b6a5209fb288b0e04d8e657dda26c59de67"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/elixir-mint/mint/security/advisories/GHSA-g586-ccqf-7x4r"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48862"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/elixir-mint/mint/security/advisories/GHSA-g586-ccqf-7x4r"
    }
  ],
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary"
    }
  ]
}

GHSA-G586-CCQF-7X4R

Vulnerability from github – Published: 2026-07-09 23:19 – Updated: 2026-07-09 23:19

Summary

mint: Unbounded streams map growth via PUSH_PROMISE without follow-up HEADERS

Details

Summary

Mint's HTTP/2 client accepts PUSH_PROMISE frames from any server it connects to and inserts every promised stream into a per-connection map without consulting max_concurrent_streams. A malicious or compromised HTTP/2 server can flood the client with PUSH_PROMISE frames and withhold the matching response HEADERS, pinning one map entry per frame indefinitely until the client process runs out of memory.

Details

'Elixir.Mint.HTTP2':handle_push_promise/3 in lib/mint/http2.ex dispatches every inbound PUSH_PROMISE frame to 'Elixir.Mint.HTTP2':decode_push_promise_headers_and_add_response/5, which inserts a :reserved_remote entry into conn.streams for the promised ID. The only validation applied is that the promised ID is even and not already present; client_settings.max_concurrent_streams is not consulted at promise time.

The concurrency cap is only checked when the response HEADERS for the promised stream arrive. A server that emits PUSH_PROMISE frames and never sends the matching HEADERS never trips that check, and the existing tally counts only streams in open states, not :reserved_remote entries.

HTTP/2 server push is accepted by default (client_settings.enable_push defaults to true), so no application opt-in is required. A single long-lived HTTP/2 connection to a hostile server lets it pin one conn.streams entry per PUSH_PROMISE frame, with no upper bound.

PoC

Stand up a raw TCP HTTP/2 server that completes the handshake and ACKs the client's SETTINGS.
Wait for the client's request HEADERS and capture its odd stream ID.
Send a flood of PUSH_PROMISE frames (flags = END_HEADERS) associated with the captured stream, each promising a fresh even stream ID and carrying a minimal HPACK-encoded header block.
Never send the matching response HEADERS for any of the promised IDs.
The client's conn.streams map grows by one entry per PUSH_PROMISE frame (~148 bytes/entry); memory grows linearly and the BEAM process eventually crashes with OOM.

Impact

Remote, unauthenticated denial-of-service against any process using Mint as an HTTP/2 client against an untrusted or attacker-influenced server. Server push is on by default, so no application code change can prevent it short of disabling push or upgrading. Affected populations include outbound HTTP/2 clients in web backends, webhook delivery systems, scrapers, federated and proxy components, and any service that follows redirects to third-party HTTP/2 origins.

Workarounds

Disable HTTP/2 server push on connections to untrusted servers by passing client_settings: [enable_push: false] to 'Elixir.Mint.HTTP':connect/4. Mint will then reject any inbound PUSH_PROMISE frame with a PROTOCOL_ERROR before the vulnerable code path is reached.

Resources

Introduction commit: https://github.com/elixir-mint/mint/commit/65c6394d05a1b8aa4a7461708c3aa173e8d7a5cf
Patch commit: https://github.com/elixir-mint/mint/commit/70b97b6a5209fb288b0e04d8e657dda26c59de67

Severity

8.2 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Hex",
        "name": "mint"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.2.0"
            },
            {
              "fixed": "1.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-48862"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-09T23:19:29Z",
    "nvd_published_at": "2026-06-02T16:16:44Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nMint\u0027s HTTP/2 client accepts `PUSH_PROMISE` frames from any server it connects to and inserts every promised stream into a per-connection map without consulting `max_concurrent_streams`. A malicious or compromised HTTP/2 server can flood the client with `PUSH_PROMISE` frames and withhold the matching response `HEADERS`, pinning one map entry per frame indefinitely until the client process runs out of memory.\n\n### Details\n\n`\u0027Elixir.Mint.HTTP2\u0027:handle_push_promise/3` in `lib/mint/http2.ex` dispatches every inbound `PUSH_PROMISE` frame to `\u0027Elixir.Mint.HTTP2\u0027:decode_push_promise_headers_and_add_response/5`, which inserts a `:reserved_remote` entry into `conn.streams` for the promised ID. The only validation applied is that the promised ID is even and not already present; `client_settings.max_concurrent_streams` is not consulted at promise time.\n\nThe concurrency cap is only checked when the response `HEADERS` for the promised stream arrive. A server that emits `PUSH_PROMISE` frames and never sends the matching `HEADERS` never trips that check, and the existing tally counts only streams in open states, not `:reserved_remote` entries.\n\nHTTP/2 server push is accepted by default (`client_settings.enable_push` defaults to `true`), so no application opt-in is required. A single long-lived HTTP/2 connection to a hostile server lets it pin one `conn.streams` entry per `PUSH_PROMISE` frame, with no upper bound.\n\n### PoC\n\n1. Stand up a raw TCP HTTP/2 server that completes the handshake and ACKs the client\u0027s `SETTINGS`.\n2. Wait for the client\u0027s request `HEADERS` and capture its odd stream ID.\n3. Send a flood of `PUSH_PROMISE` frames (`flags = END_HEADERS`) associated with the captured stream, each promising a fresh even stream ID and carrying a minimal HPACK-encoded header block.\n4. Never send the matching response `HEADERS` for any of the promised IDs.\n5. The client\u0027s `conn.streams` map grows by one entry per `PUSH_PROMISE` frame (~148 bytes/entry); memory grows linearly and the BEAM process eventually crashes with OOM.\n\n### Impact\n\nRemote, unauthenticated denial-of-service against any process using Mint as an HTTP/2 client against an untrusted or attacker-influenced server. Server push is on by default, so no application code change can prevent it short of disabling push or upgrading. Affected populations include outbound HTTP/2 clients in web backends, webhook delivery systems, scrapers, federated and proxy components, and any service that follows redirects to third-party HTTP/2 origins.\n\n## Workarounds\n\nDisable HTTP/2 server push on connections to untrusted servers by passing `client_settings: [enable_push: false]` to `\u0027Elixir.Mint.HTTP\u0027:connect/4`. Mint will then reject any inbound `PUSH_PROMISE` frame with a `PROTOCOL_ERROR` before the vulnerable code path is reached.\n\n## Resources\n\n* Introduction commit: https://github.com/elixir-mint/mint/commit/65c6394d05a1b8aa4a7461708c3aa173e8d7a5cf\n* Patch commit: https://github.com/elixir-mint/mint/commit/70b97b6a5209fb288b0e04d8e657dda26c59de67",
  "id": "GHSA-g586-ccqf-7x4r",
  "modified": "2026-07-09T23:19:29Z",
  "published": "2026-07-09T23:19:29Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/elixir-mint/mint/security/advisories/GHSA-g586-ccqf-7x4r"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48862"
    },
    {
      "type": "WEB",
      "url": "https://github.com/elixir-mint/mint/commit/70b97b6a5209fb288b0e04d8e657dda26c59de67"
    },
    {
      "type": "WEB",
      "url": "https://cna.erlef.org/cves/CVE-2026-48862.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/elixir-mint/mint"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48862"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "mint: Unbounded streams map growth via PUSH_PROMISE without follow-up HEADERS"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-48862 (GCVE-0-2026-48862)

FKIE_CVE-2026-48862

GHSA-G586-CCQF-7X4R

Summary

Details

PoC

Impact

Workarounds

Resources

Tags

Sightings

Nomenclature