Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-49754— HTTP/2 CONTINUATION flood in Mint client via unbounded header-block accumulation

Quick assessment

Affected
elixir-mint mint
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Mint是Elixir Mint开源的一个功能性的底层HTTP客户端库。 Mint 0.1.0版本至1.9.0之前版本存在安全漏洞，该漏洞源于资源分配无限制，可能导致攻击者控制的HTTP/2服务器耗尽Mint客户端内存。

AI Predicted 7.5 Difficulty: Easy EPSS 0.38% · P32

Possible ATT&CK Techniques 1 AI

T1496 · Resource Hijacking

Affected Version Matrix 2

VendorProduct Version RangeStatus
elixir-mint mint 0.1.0< 1.9.0 affected
596ca4304504be68939c4929e0831557097962b8< b662d127d3028b5426c88d4c9cc7fe430491a10b affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-49754

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
HTTP/2 CONTINUATION flood in Mint client via unbounded header-block accumulation
Source: CVE Program / CVE List V5
Vulnerability Description
Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint Mint allows attacker-controlled HTTP/2 servers to exhaust memory in a Mint client (HTTP/2 CONTINUATION flood). When Mint's HTTP/2 receive path observes a HEADERS frame without the END_HEADERS flag, the unparsed header-block fragment is parked in conn.headers_being_processed, and every subsequent CONTINUATION frame on that stream is appended to the accumulator. Nothing in the receive path caps the accumulator: there is no per-stream size limit, no CONTINUATION frame-count limit, and max_header_list_size is only enforced on outgoing requests, never on inbound header blocks (its default is :infinity). A malicious or compromised HTTP/2 server can stream an endless sequence of CONTINUATION frames (each up to the peer-advertised SETTINGS_MAX_FRAME_SIZE) and drive the client's iolist to arbitrary size, causing memory exhaustion and BEAM process death. A single connection to an attacker-controlled HTTP/2 endpoint is sufficient. This issue affects mint: from 0.1.0 before 1.9.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5
Vulnerability Title
Mint 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Mint是Elixir Mint开源的一个功能性的底层HTTP客户端库。 Mint 0.1.0版本至1.9.0之前版本存在安全漏洞，该漏洞源于资源分配无限制，可能导致攻击者控制的HTTP/2服务器耗尽Mint客户端内存。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
elixir-mint mint 0.1.0 ~ 1.9.0 cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*
elixir-mint mint 596ca4304504be68939c4929e0831557097962b8 ~ b662d127d3028b5426c88d4c9cc7fe430491a10b cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-49754

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-49754

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-49754 (1)

Vendor Advisories for CVE-2026-49754 (3)

Same Patch Batch · elixir-mint · 2026-06-02 · 4 CVEs total

CVE-2026-48862 Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrenc
CVE-2026-48861 CRLF injection in HTTP/1 request line via unvalidated method in Mint
CVE-2026-49753 HTTP response smuggling in Mint HTTP/1 client via lenient Content-Length parsing

IV. Related Vulnerabilities

Same product: mint
Same vendor: elixir-mint
Same weakness: CWE-770