Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-91043— HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memory

Quick assessment

Affected
elixir-mint mint
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

elixir-mint 库中的“无限制或限流下的资源分配”漏洞允许恶意的 HTTP/2 服务器耗尽客户端主机的内存，从而导致拒绝服务（DoS）。 Mint.HTTP2 仅在入站头块的压缩大小上强制执行客户端的 设置，而 RFC 9113 第 6.5.2 节定义的限制是针对解码后的头列表大小。HPACK 索引字段在传输中仅占一个字节，但解码后可能成为动态表中高达 4 KB 的条目。同时， 中的 函数会将响应中的每个 cookie 值复制到一个新的二进制数据（binary）中。因此，在默认的 256 KB 传输限制下，

CVSS 8.2 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-91043

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memory
Source: CVE Program / CVE List V5
Vulnerability Description
Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to exhaust memory on the client host and cause a denial of service. Mint.HTTP2 enforces the client's max_header_list_size setting only on the compressed size of an inbound header block, while RFC 9113 section 6.5.2 defines the limit on the decoded header list. An HPACK indexed field costs one byte on the wire and decodes to a dynamic table entry of up to 4 KB, and join_cookie_headers/1 in lib/mint/http2.ex copies every cookie value of a response into one new binary. A header block under the default 256 KB wire limit therefore makes the client allocate about 1 GB for a single response, and several such responses in one delivery exhaust the memory of the process that owns the connection or of the whole VM. This issue affects mint: from 1.1.0 before 1.11.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
elixir-mint mint 1.1.0 ~ 1.11.0 cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*
elixir-mint mint 8e0e04680476f90f9f68db4dfeabcbe66dabfc4d ~ c7895cb022196c77ec35570c8e873a84393ff4b8 cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-91043

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-91043

请登录查看更多情报信息。

Other References for CVE-2026-91043 (5)

Same Patch Batch · elixir-mint · 2026-09-28 · 3 CVEs total

CVE-2026-94194 6.3 MEDIUM Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding,
CVE-2026-92103 6.3 MEDIUM Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size

IV. Related Vulnerabilities

Same product: mint
Same vendor: elixir-mint
Same weakness: CWE-770

V. Comments for CVE-2026-91043

No comments yet

Leave a comment