Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-82729— Quadratic chunk-size parsing in Mint.HTTP1.Parse allows CPU-exhaustion DoS

Quick assessment

Affected
elixir-mint mint
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

elicit-mint 库中 （位于 中）存在低效算法复杂度漏洞，允许远程 HTTP 服务器耗尽客户端主机的 CPU 资源，从而引发服务中断（DoS）。 具体而言， 在解析分块传输（chunked response）的块大小字段时，将每个十六进制数字折叠到一个任意精度累加器中（ ），且未对数字个数设置上限。由于累加器会无限增长，乘法操作并非恒定时间，处理 N 个数字的成本为 O(N²)。此外， 在每条 socket 消息到达时都会将 前置并从起始位置重新解析，因此若服务器将数字拆分为小包逐步发送，客户端将反复承担这

CVSS 6.3 · Medium

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 2

VendorProduct Version RangeStatus
elixir-mint mint 1.9.3< 1.10.0 affected
fc7d16538db7e40b56ed489f08683225cb0197fa< bd2a4e7513594997c140cfef9fe0e968712fb588 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-82729

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Quadratic chunk-size parsing in Mint.HTTP1.Parse allows CPU-exhaustion DoS
Source: CVE Program / CVE List V5
Vulnerability Description
Inefficient Algorithmic Complexity vulnerability in elixir-mint mint allows a remote HTTP server to exhaust CPU on the client host and cause a denial of service. parse_hex_prefix/2 in lib/mint/http1/parse.ex folds each hex digit of a chunked response's chunk-size field into an arbitrary-precision accumulator with acc * 16 + digit and imposes no limit on the digit count. Because the accumulator grows without bound, the multiplication is not constant time and one pass over N digits costs O(N squared). handle_data/2 prepends conn.buffer and re-parses from the start on every socket message, so a server that dribbles the digits out in small packets makes the client pay that cost repeatedly. A run of roughly 512,000 hex digits costs over ten seconds of CPU in a single pass, measured on stock defaults. The parser reaches this state after a valid status line and a complete, valid header section, so an intermediary inspecting only headers sees an ordinary 200 response. This issue affects mint: from 1.9.3 before 1.10.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
算法复杂性
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
elixir-mint mint 1.9.3 ~ 1.10.0 cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*
elixir-mint mint fc7d16538db7e40b56ed489f08683225cb0197fa ~ bd2a4e7513594997c140cfef9fe0e968712fb588 cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-82729

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-82729

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-82729 (1)

Vendor Advisories for CVE-2026-82729 (3)

IV. Related Vulnerabilities

Same product: mint
Same vendor: elixir-mint
Same weakness: CWE-407

V. Comments for CVE-2026-82729

No comments yet

Leave a comment