dbcve.org
Resource Allocation Without LimitsWeakness · CWE-770

CVE-2026-58229

HIGH · 8.2 CVSS v4.0 Published 2026-07-14
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
91/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click 5 weeks old

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Allocation of resources without limits vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client host and cause a denial of service. The Mint.HTTP1.decode_headers/5 and Mint.HTTP1.decode_trailer_headers/4 functions in lib/mint/http1.ex accumulate every parsed response header and chunked-trailer field into a per-request list that persists across incoming TCP segments as request.headers_buffer, and only clear it when the terminating blank line is received. The section has no cap on the number of headers or on total bytes, and the underlying :erlang.decode_packet(:httph_bin, binary, []) parser is invoked with an empty option list so its per-line and per-packet size limits also default to unlimited. A malicious HTTP server (reachable directly, via an attacker-controlled redirect, via SSRF, or via a man-in-the-middle) can stream complete header lines (or, after a chunked body, complete trailer lines) indefinitely without ever emitting the terminating blank line. The connection state grows without bound until the BEAM node is killed by the operating system's out-of-memory handler, taking down the entire application that uses Mint as an HTTP client. This issue affects mint: from 0.1.0 before 1.9.2.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

The Mint.HTTP1 module lacks resource limits on HTTP response header parsing. The decode_headers/5 and decode_trailer_headers/4 functions accumulate all received headers into an unbounded headers_buffer list, and the underlying :erlang.decode_packet(:httph_bin, ...) is called without size restrictions. A malicious server can stream unlimited header data without sending the terminating blank line, causing unbounded memory growth until the BEAM process is killed by OOM.

MitigationUpgrade mint to version 1.9.2 or later, which implements header count and byte limits. Until then, restrict connections to trusted HTTP servers and monitor memory usage for Mint client connections.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
Authentication
X
User interaction
None
Scope
X

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify installed Mint library version
    Check your mix.exs deps or run `mix hex.info mint` or `ls _build/*/deps/mint` to find the version. Alternatively, inspect the BEAM modules at runtime via `:code.which(Mint.HTTP1)`
    Affected if The installed version is below 1.9.2
  2. Confirm Mint.HTTP1 is in use
    Search your codebase for `Mint.HTTP1` module references, particularly calls to decode_headers/5 or decode_trailer_headers/4 functions
    Affected if Your application uses the Mint.HTTP1 module to process HTTP responses from external servers
  3. Check network connectivity to untrusted servers
    Inspect your application configuration and code to determine if Mint HTTP clients connect to servers outside your trusted network boundary
    Affected if Your Mint clients connect to arbitrary or untrusted HTTP servers without firewall or proxy restrictions
  4. Monitor BEAM memory for Mint client processes
    Observe memory consumption of BEAM processes running Mint HTTP clients. Use `:erlang.process_info(pid, memory)` or monitoring tools to track growth over time
    Affected if Memory usage grows unboundedly without a corresponding increase in processed response data
  5. Verify if header limits are enforced
    Review Mint configuration or wrapper code to check if any header count or size limits are applied before calling decode_headers/decode_trailer_headers
    Affected if No application-level limits are imposed on header count or size before passing data to the Mint decode functions

You are affected if you run Mint version below 1.9.2 and your application uses Mint.HTTP1 to connect to external HTTP servers where a malicious server could send unbounded headers.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Upgrade mint to version 1.9.2 or later, which implements header count and byte limits. Until then, restrict connections to trusted HTTP servers and monitor memory usage for Mint client connections.

Recommended fix High confidence

1.9.2

  1. Upgrade the Mint dependency in your mix.exs or deps configuration to version 1.9.2 or later
  2. Run mix deps.get to fetch the updated dependency
  3. Run mix deps.compile to recompile Mint
  4. Verify the application compiles and tests pass
  5. Redeploy the application

Generated from the published advisory — verify against the referenced sources before acting.

Have this fixed Scoped from the published advisory
  • Consultation2.0 h
  • Implementation8.0 h
  • Testing4.0 h
  • Review / QA2.0 h
16.0 hours of engineering $2,800
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $4,480.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-58229 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-58229 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data