Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1310 CNY

100%
Buy Us a Coffee

CVE-2026-49754— HTTP/2 CONTINUATION flood in Mint client via unbounded header-block accumulation

AI Predicted 7.5 Difficulty: Easy

Possible ATT&CK Techniques 1AI

T1496 · Resource Hijacking

Affected Version Matrix 2

VendorProductVersion RangeStatus
elixir-mintmint0.1.0< 1.9.0affected
596ca4304504be68939c4929e0831557097962b8< b662d127d3028b5426c88d4c9cc7fe430491a10baffected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-49754

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
HTTP/2 CONTINUATION flood in Mint client via unbounded header-block accumulation
Source: NVD (National Vulnerability Database)
Vulnerability Description
Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint Mint allows attacker-controlled HTTP/2 servers to exhaust memory in a Mint client (HTTP/2 CONTINUATION flood). When Mint's HTTP/2 receive path observes a HEADERS frame without the END_HEADERS flag, the unparsed header-block fragment is parked in conn.headers_being_processed, and every subsequent CONTINUATION frame on that stream is appended to the accumulator. Nothing in the receive path caps the accumulator: there is no per-stream size limit, no CONTINUATION frame-count limit, and max_header_list_size is only enforced on outgoing requests, never on inbound header blocks (its default is :infinity). A malicious or compromised HTTP/2 server can stream an endless sequence of CONTINUATION frames (each up to the peer-advertised SETTINGS_MAX_FRAME_SIZE) and drive the client's iolist to arbitrary size, causing memory exhaustion and BEAM process death. A single connection to an attacker-controlled HTTP/2 endpoint is sufficient. This issue affects mint: from 0.1.0 before 1.9.0.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
不加限制或调节的资源分配
Source: NVD (National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
elixir-mintmint 0.1.0 ~ 1.9.0 cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*
elixir-mintmint 596ca4304504be68939c4929e0831557097962b8 ~ b662d127d3028b5426c88d4c9cc7fe430491a10b cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-49754

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-49754

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-49754 (1)

Vendor Advisories for CVE-2026-49754 (3)

Same Patch Batch · elixir-mint · 2026-06-02 · 4 CVEs total

CVE-2026-48862Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrenc
CVE-2026-48861CRLF injection in HTTP/1 request line via unvalidated method in Mint
CVE-2026-49753HTTP response smuggling in Mint HTTP/1 client via lenient Content-Length parsing

IV. Related Vulnerabilities

Same product: mint
Same vendor: elixir-mint
Same weakness: CWE-770

V. Comments for CVE-2026-49754

No comments yet

Leave a comment