CVE-2026-48862 Details
Description
Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint Mint allows attacker-controlled HTTP/2 servers to exhaust memory in a Mint client via PUSH_PROMISE flooding. In lib/mint/http2.ex, Mint.HTTP2.decode_push_promise_headers_and_add_response/5 inserts a :reserved_remote entry into conn.streams for every promised stream ID. The neighbouring Mint.HTTP2.assert_valid_promised_stream_id/2 only verifies that the promised ID is even and not already present; client_settings.max_concurrent_streams is not consulted at promise time. The concurrency cap is only checked when the response HEADERS for the promised stream arrive, so a server that emits PUSH_PROMISE frames and withholds the matching HEADERS never trips that check. HTTP/2 server push is accepted by default (client_settings.enable_push defaults to true). A single long-lived HTTP/2 connection to a hostile server lets that server pin one conn.streams entry per PUSH_PROMISE frame it sends, with no upper bound, until the client process runs out of memory. This issue affects mint: from 0.2.0 before 1.9.0.
A vulnerability in the Elixir Mint HTTP client, specifically in versions 0.2.0 prior to 1.9.0, allows attacker-controlled HTTP/2 servers to exhaust the client's memory. This is achieved by flooding the client with PUSH_PROMISE frames and withholding the corresponding response HEADERS, leading to a denial-of-service condition. The issue arises because the client does not properly enforce concurrency limits on promised streams, allowing a malicious server to pin an unbounded number of streams and cause the client process to run out of memory.
Users can upgrade to Mint version 1.9.0 or later, where this vulnerability has been fixed. Alternatively, HTTP/2 server push can be disabled on connections to untrusted servers by passing 'client_settings: [enable_push: false]' to 'Elixir.Mint.HTTP:connect/4'.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 2, 2026CISA-ADP
Assessed Jun 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/elixir-mint/mint/security/advisories/GHSA-g586-ccqf-7x4r | CISA-ADP | AdvisoryRemedyVendor |
| https://cna.erlef.org/cves/CVE-2026-48862.html | EEF | AdvisoryRemedy |
| https://github.com/elixir-mint/mint/commit/70b97b6a5209fb288b0e04d8e657dda26c59de67 | EEF | Source CodeVendor |
| https://github.com/elixir-mint/mint/security/advisories/GHSA-g586-ccqf-7x4r | EEF | AdvisoryRemedyVendor |
| https://osv.dev/vulnerability/EEF-CVE-2026-48862 | EEF | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | EEF |
Affected Products
| Product | Versions |
|---|---|
| elixir-mint Mint | >= 0.2.0, < 1.9.0 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | EEF |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 2, 2026 | CVE Modified | CISA-ADP |
| Jun 2, 2026 | New CVE Received | EEF |