CVE-2026-48862
Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrency
Description
Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint Mint allows attacker-controlled HTTP/2 servers to exhaust memory in a Mint client via PUSH_PROMISE flooding. In lib/mint/http2.ex, Mint.HTTP2.decode_push_promise_headers_and_add_response/5 inserts a :reserved_remote entry into conn.streams for every promised stream ID. The neighbouring Mint.HTTP2.assert_valid_promised_stream_id/2 only verifies that the promised ID is even and not already present; client_settings.max_concurrent_streams is not consulted at promise time. The concurrency cap is only checked when the response HEADERS for the promised stream arrive, so a server that emits PUSH_PROMISE frames and withholds the matching HEADERS never trips that check. HTTP/2 server push is accepted by default (client_settings.enable_push defaults to true). A single long-lived HTTP/2 connection to a hostile server lets that server pin one conn.streams entry per PUSH_PROMISE frame it sends, with no upper bound, until the client process runs out of memory. This issue affects mint: from 0.2.0 before 1.9.0.
INFO
Published Date :
June 2, 2026, 4:16 p.m.
Last Modified :
July 22, 2026, 7:10 p.m.
Remotely Exploit :
Yes !
Source :
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 4.0 | HIGH | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db | ||||
| CVSS 4.0 | HIGH | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db |
Solution
- Update the Mint library to version 1.9.0 or later.
- Review and enforce connection stream limits.
- Disable HTTP/2 server push if not required.
- Monitor resource usage on long-lived connections.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-48862.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-48862 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-48862
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-48862 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-48862 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Jul. 22, 2026
Action Type Old Value New Value Added Translation Title: mint de elixir-mint, Description: Vulnerabilidad de asignación de recursos sin límites ni limitación en elixir-mint Mint permite a servidores HTTP/2 controlados por atacantes agotar la memoria en un cliente Mint mediante inundación de PUSH_PROMISE. En lib/mint/http2.ex, Mint.HTTP2.decode_push_promise_headers_and_add_response/5 inserta una entrada :reserved_remote en conn.streams para cada ID de flujo prometido. La función adyacente Mint.HTTP2.assert_valid_promised_stream_id/2 solo verifica que el ID prometido sea par y no esté ya presente; client_settings.max_concurrent_streams no se consulta en el momento de la promesa. El límite de concurrencia solo se verifica cuando llegan los HEADERS de respuesta para el flujo prometido, por lo que un servidor que emite tramas PUSH_PROMISE y retiene los HEADERS coincidentes nunca activa esa verificación. El envío de servidor HTTP/2 se acepta por defecto (client_settings.enable_push por defecto es true). Una única conexión HTTP/2 de larga duración a un servidor hostil permite a ese servidor fijar una entrada conn.streams por cada trama PUSH_PROMISE que envía, sin límite superior, hasta que el proceso del cliente se quede sin memoria. Este problema afecta a mint: desde 0.2.0 antes de 1.9.0. -
CVE Modified by 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'cpes': ['cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*'], 'repo': 'https://github.com/elixir-mint/mint', 'vendor': 'elixir-mint', 'modules': ["'Elixir.Mint.HTTP2'"], 'product': 'mint', 'versions': [{'status': 'affected', 'version': '0.2.0', 'lessThan': '1.9.0', 'versionType': 'semver'}], 'packageURL': 'pkg:hex/mint', 'packageName': 'mint', 'programFiles': ['lib/mint/http2.ex'], 'collectionURL': 'https://repo.hex.pm', 'defaultStatus': 'unaffected', 'programRoutines': [{'name': "'Elixir.Mint.HTTP2':handle_push_promise/3"}, {'name': "'Elixir.Mint.HTTP2':decode_push_promise_headers_and_add_response/5"}]}, {'cpes': ['cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*'], 'repo': 'https://github.com/elixir-mint/mint.git', 'vendor': 'elixir-mint', 'modules': ["'Elixir.Mint.HTTP2'"], 'product': 'mint', 'versions': [{'status': 'affected', 'version': '65c6394d05a1b8aa4a7461708c3aa173e8d7a5cf', 'lessThan': '70b97b6a5209fb288b0e04d8e657dda26c59de67', 'versionType': 'git'}], 'packageURL': 'pkg:github/elixir-mint/mint', 'packageName': 'elixir-mint/mint', 'programFiles': ['lib/mint/http2.ex'], 'collectionURL': 'https://github.com', 'defaultStatus': 'unaffected', 'programRoutines': [{'name': "'Elixir.Mint.HTTP2':handle_push_promise/3"}, {'name': "'Elixir.Mint.HTTP2':decode_push_promise_headers_and_add_response/5"}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-48862', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'yes'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-06-02T18:11:00.524487Z'} -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 02, 2026
Action Type Old Value New Value Added Reference https://github.com/elixir-mint/mint/security/advisories/GHSA-g586-ccqf-7x4r -
New CVE Received by 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Jun. 02, 2026
Action Type Old Value New Value Added Description Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint Mint allows attacker-controlled HTTP/2 servers to exhaust memory in a Mint client via PUSH_PROMISE flooding. In lib/mint/http2.ex, Mint.HTTP2.decode_push_promise_headers_and_add_response/5 inserts a :reserved_remote entry into conn.streams for every promised stream ID. The neighbouring Mint.HTTP2.assert_valid_promised_stream_id/2 only verifies that the promised ID is even and not already present; client_settings.max_concurrent_streams is not consulted at promise time. The concurrency cap is only checked when the response HEADERS for the promised stream arrive, so a server that emits PUSH_PROMISE frames and withholds the matching HEADERS never trips that check. HTTP/2 server push is accepted by default (client_settings.enable_push defaults to true). A single long-lived HTTP/2 connection to a hostile server lets that server pin one conn.streams entry per PUSH_PROMISE frame it sends, with no upper bound, until the client process runs out of memory. This issue affects mint: from 0.2.0 before 1.9.0. Added CVSS V4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-770 Added Reference https://cna.erlef.org/cves/CVE-2026-48862.html Added Reference https://github.com/elixir-mint/mint/commit/70b97b6a5209fb288b0e04d8e657dda26c59de67 Added Reference https://github.com/elixir-mint/mint/security/advisories/GHSA-g586-ccqf-7x4r Added Reference https://osv.dev/vulnerability/EEF-CVE-2026-48862