🚨 HIGH - Unbounded header/trailer accumulation DoS in Mint HTTP/1 decoder (CVE-2026-58229) A resource allocation without limits flaw in the elixir-mint Mint HTTP/1 decoder lets a malicious remote HTTP server force unbounded memory growth on the client. The root cause is improper input validation/resource limits: the decoder keeps accumulating response headers or chunked trailer fields across TCP segments with no cap and only clears them after a terminating blank line. An attacker exploits this by serving an HTTP/1 response that never sends the terminating blank line, requiring no client-side privileges beyond the victim making a request to the attacker-controlled server. Impact is client-side denial of service via memory exhaustion, potentially OOM-killing the BEAM node and taking down any application using Mint as an HTTP client. 👉 Affected: mint (HTTP/1 decoder) | No fix yet - treat as suspicious
Post summary
This post discloses CVE-2026-58229, a DoS vulnerability in the Mint HTTP/1 decoder that allows memory exhaustion via unbounded header accumulation; it includes technical details but no PoC, exploit code, or active usage reports, and no patch is available.
