CVE-2026-92103 Details
Description
Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to make the client hold up to about 16 MiB per connection in frames it should reject, consuming client memory. Mint.HTTP2.Frame.decode_next/2 in lib/mint/http2/frame.ex compares a frame with the client's max_frame_size (16,384 bytes by default) only once the whole declared payload has arrived. Until then it returns :more, and Mint.HTTP2 keeps every received byte in the connection buffer. A server can declare a frame length of up to 16,777,215 bytes and withhold the last byte, keeping roughly 1,024 times the advertised limit buffered for as long as the connection stays open. The server has to send every byte the client buffers, so there is no amplification, and the buffer stops at the 24-bit frame length limit. This issue affects mint: from 0.1.0 before 1.10.2.
A resource allocation vulnerability without proper limits or throttling has been identified in the Elixir Mint HTTP client library, specifically in versions 0.1.0 prior to 1.11.0. This vulnerability allows a malicious HTTP/2 server to cause the client to buffer oversized frames, effectively consuming memory and leading to potential memory exhaustion. The issue arises because the frame decoder only checks the size of the payload after the entire declared length has been received. Until then, the decoder indicates that more data is needed, while the client inadvertently stores all incoming bytes in a connection buffer. As a result, a server can exploit this by declaring a frame length of up to 16,777,215 bytes, withholding the final byte, and keeping approximately 16 MiB per connection buffered for as long as the connection remains open.
Users can upgrade to Elixir Mint version 1.11.0 or later, where this vulnerability has been fixed. Instructions for updating can be found on the Elixir Mint GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 28, 2026CISA-ADP
Assessed Sep 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.erlef.org/cves/CVE-2026-92103.html | EEF | AdvisoryTechnical Analysis |
| https://github.com/elixir-mint/mint/commit/20252ca85065f4d1092aed9ee4ed21841a507dfe | EEF | Source CodeVendor |
| https://github.com/elixir-mint/mint/commit/44d7ce4755d0444ee415cbcca7ce4942382da4dd | EEF | |
| https://github.com/elixir-mint/mint/commit/596ca4304504be68939c4929e0831557097962b8 | EEF | Source CodeVendor |
| https://github.com/elixir-mint/mint/security/advisories/GHSA-q95c-ccq6-j5j6 | EEF | AdvisoryRemedyVendor |
| https://osv.dev/vulnerability/EEF-CVE-2026-92103 | EEF | AdvisoryExploitTechnical Analysis |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | EEF |
Affected Products
| Product | Versions |
|---|---|
| elixir-mint mint | >= 0.1.0, < 1.11.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 30, 2026 | CVE Modified | CISA-ADP |
| Sep 29, 2026 | CVE Modified | EEF |
| Sep 28, 2026 | New CVE Received | EEF |