Description
Inefficient Algorithmic Complexity vulnerability in elixir-mint mint allows a remote HTTP server to exhaust CPU on the client host and cause a denial of service.

parse_hex_prefix/2 in lib/mint/http1/parse.ex folds each hex digit of a chunked response's chunk-size field into an arbitrary-precision accumulator with acc * 16 + digit and imposes no limit on the digit count. Because the accumulator grows without bound, the multiplication is not constant time and one pass over N digits costs O(N squared). handle_data/2 prepends conn.buffer and re-parses from the start on every socket message, so a server that dribbles the digits out in small packets makes the client pay that cost repeatedly. A run of roughly 512,000 hex digits costs over ten seconds of CPU in a single pass, measured on stock defaults. The parser reaches this state after a valid status line and a complete, valid header section, so an intermediary inspecting only headers sees an ordinary 200 response.

This issue affects mint: from 1.9.3 before 1.10.0.
Published: 2026-09-04
Score: 6.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability arises from a quadratic algorithm used to parse the hexadecimal chunk‑size field in HTTP/1.1 chunked responses. The parser multiplies an arbitrary‑precision accumulator by 16 for each hex digit without imposing a maximum length, causing O(N²) processing time. When a server sends a very long chunk‑size split across many small packets, the client repeatedly re‑parses the data, consuming an excessive amount of CPU and potentially refusing service.

Affected Systems

Affected versions of elixir‑mint are those tagged 1.9.3 and any earlier releases before 1.10.0. All installations using the mint library in this range are vulnerable.

Risk and Exploitability

The CVSS score of 6.3 indicates a moderate risk, while the EPSS score is unavailable and the vulnerability is not currently listed in the CISA KEV catalog. An attacker can trigger the DoS from an external HTTP server by delivering a chunked response whose chunk‑size header contains a very large number of hex digits, especially when the digits are sent in numerous small fragments to force the client to re‑parse repeatedly. The attack does not require authentication and impacts only the client side, exhausting CPU resources until the client stalls or exits.

Generated by OpenCVE AI on September 4, 2026 at 15:30 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade elixir‑mint to version 1.10.0 or later, which contains the patch for the chunk‑size parser.
  • If an upgrade is not immediately possible, apply a patch that limits the maximum length of the chunk‑size field or otherwise replaces the vulnerable parsing function with a constant‑time implementation.
  • Monitor client processes for abnormal CPU usage and enforce timeouts or process isolation to contain potential service disruptions.

Generated by OpenCVE AI on September 4, 2026 at 15:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 04 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
Description Inefficient Algorithmic Complexity vulnerability in elixir-mint mint allows a remote HTTP server to exhaust CPU on the client host and cause a denial of service. parse_hex_prefix/2 in lib/mint/http1/parse.ex folds each hex digit of a chunked response's chunk-size field into an arbitrary-precision accumulator with acc * 16 + digit and imposes no limit on the digit count. Because the accumulator grows without bound, the multiplication is not constant time and one pass over N digits costs O(N squared). handle_data/2 prepends conn.buffer and re-parses from the start on every socket message, so a server that dribbles the digits out in small packets makes the client pay that cost repeatedly. A run of roughly 512,000 hex digits costs over ten seconds of CPU in a single pass, measured on stock defaults. The parser reaches this state after a valid status line and a complete, valid header section, so an intermediary inspecting only headers sees an ordinary 200 response. This issue affects mint: from 1.9.3 before 1.10.0.
Title Quadratic chunk-size parsing in Mint.HTTP1.Parse allows CPU-exhaustion DoS
First Time appeared Elixir-mint
Elixir-mint mint
Weaknesses CWE-407
CPEs cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*
Vendors & Products Elixir-mint
Elixir-mint mint
References
Metrics cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Elixir-mint Mint
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-09-04T19:33:32.398Z

Reserved: 2026-08-31T00:59:08.960Z

Link: CVE-2026-82729

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-04T15:17:36.120

Modified: 2026-09-04T20:17:29.953

Link: CVE-2026-82729

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-04T15:45:04Z

Weaknesses
  • CWE-407

    Inefficient Algorithmic Complexity