CVE-2026-82728

Name of the Vulnerable Software and Affected Versions elixir-mint versions 0.1.0 through 1.9.9

Description A remote HTTP server can cause a denial of service by exhausting memory on the client host. This occurs because two HTTP/1 response-parser states accumulate server data without limits. Specifically, the decode status line/4 function stores unconsumed data in conn.buffer when the status line is incomplete, and the decode body/5 function does the same for an unterminated chunk-extension line. Both functions wait for a CRLF (Carriage Return Line Feed) sequence that a malicious server may never send, causing conn.buffer to be prepended to every subsequent socket message. While a budget exists via :max header list size, it only applies to decode headers/5 and decode trailer headers/4, leaving these two states unprotected. An attacker can stream bytes indefinitely until the BEAM node is terminated by the operating system's out-of-memory handler. In the case of chunk-extensions, the attack occurs after a valid status line and header section, potentially bypassing intermediaries that only inspect headers.

Recommendations Update elixir-mint to version 1.10.0 or later.