CVE-2026-58229— Elixir Mint Mint 资源管理错误漏洞

Unbounded HTTP/1 response-header and chunked-trailer accumulation in Mint causes memory-exhaustion DoS

Allocation of resources without limits vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client host and cause a denial of service. The Mint.HTTP1.decode_headers/5 and Mint.HTTP1.decode_trailer_headers/4 functions in lib/mint/http1.ex accumulate every parsed response header and chunked-trailer field into a per-request list that persists across incoming TCP segments as request.headers_buffer, and only clear it when the terminating blank line is received. The section has no cap on the number of headers or on total bytes, and the underlying :erlang.decode_packet(:httph_bin, binary, []) parser is invoked with an empty option list so its per-line and per-packet size limits also default to unlimited. A malicious HTTP server (reachable directly, via an attacker-controlled redirect, via SSRF, or via a man-in-the-middle) can stream complete header lines (or, after a chunked body, complete trailer lines) indefinitely without ever emitting the terminating blank line. The connection state grows without bound until the BEAM node is killed by the operating system's out-of-memory handler, taking down the entire application that uses Mint as an HTTP client. This issue affects mint: from 0.1.0 before 1.9.2.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

不加限制或调节的资源分配

Elixir Mint Mint 资源管理错误漏洞

elixir-mint mint是elixir-mint的HTTP客户端库。 Elixir Mint Mint 0.1.0版本至1.9.2之前版本存在资源管理错误漏洞，该漏洞源于资源无限制分配，具体涉及Mint.HTTP1.decode_headers/5和Mint.HTTP1.decode_trailer_headers/4函数，这些函数将每个解析的响应标头和分块尾部字段累积到每个请求的列表中，且无标头数量或总字节数限制，允许恶意HTTP服务器通过流式传输完整标头行无限消耗内存，导致拒绝服务。

N/A

N/A