CVE-2026-56810

Name of the Vulnerable Software and Affected Versions mint versions 0.5.0 through 1.9.0

Description A denial of service issue exists in the Mint.HTTP1 module. When decoding a chunked HTTP response body, the software accumulates partial fragments in the data buffer (an unbounded iolist) using the add body to buffer/2 function and does not emit data until the full declared chunk length is received. Because the chunk size is parsed from the server without an upper bound, a malicious server can specify an enormous chunk size and send bytes slowly. This forces the client to buffer data indefinitely, potentially leading to an out-of-memory condition. This can be triggered when a client follows redirects, fetches user-supplied URLs, or processes webhooks. The issue is associated with the decode body/5 function in the lib/mint/http1.ex file.

Recommendations Update mint to version 1.9.1 or later.