CVE-2026-82729

Name of the Vulnerable Software and Affected Versions elixir-mint versions 1.9.3 through 1.9.x

Description An inefficient algorithmic complexity issue allows a remote HTTP server to exhaust CPU resources on the client host, leading to a denial of service. The parse hex prefix/2 function in lib/mint/http1/parse.ex processes hex digits of a chunked response's chunk-size field using an arbitrary-precision accumulator without limiting the digit count. This results in O(N squared) time complexity for processing N digits. Additionally, the handle data/2 function prepends the conn.buffer and re-parses from the beginning for every socket message, which can be exploited by a server sending digits in small packets to repeatedly trigger the high CPU cost. This state is reached after a valid status line and header section, potentially bypassing intermediaries that only inspect headers.

Recommendations Update to version 1.10.0.