CVE-2026-82728

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client host and cause a denial of service. Two HTTP/1 response-parser states accumulate server data without any cap. In lib/mint/http1.ex, decode_status_line/4 stores the unconsumed data in conn.buffer when the status line is incomplete, and decode_body/5 does the same for an unterminated chunk-extension line. Both wait for a CRLF the server never has to send, and conn.buffer is prepended to every subsequent socket message. The :max_header_list_size budget is wired only into decode_headers/5 and decode_trailer_headers/4, so neither of these states is covered by it. A malicious server, or one reached through an attacker-controlled redirect or a fetched URL, streams bytes indefinitely until the BEAM node is killed by the operating system out-of-memory handler. The chunk-extension variant is reached after a valid status line and a complete, valid header section, so an intermediary inspecting only headers sees an ordinary 200 response. This issue affects mint: from 0.1.0 before 1.10.0.

• CWE-770

• https://cna.erlef.org/cves/CVE-2026-82728.html
• https://github.com/elixir-mint/mint/commit/19be5558b6a317e271c78666498dd78b151e490a
• https://github.com/elixir-mint/mint/security/advisories/GHSA-g83f-2j6r-q6m4
• https://osv.dev/vulnerability/EEF-CVE-2026-82728
• https://github.com/elixir-mint/mint/security/advisories/GHSA-g83f-2j6r-q6m4

Published

Sep 4, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-82722Allocation of Resources Without Limits or Throttling vulnera…8.3
• CVE-2026-82723Insertion of Sensitive Information into Log File vulnerabili…1.8
• CVE-2026-82724Incorrect Authorization vulnerability in ash-project ash_pho…7.6
• CVE-2026-82725Authorization Bypass Through User-Controlled Key vulnerabili…2.3
• CVE-2026-82726Permissive Regular Expression vulnerability in ash-project a…6.3
• CVE-2026-82727Generation of Error Message Containing Sensitive Information…2.3
• CVE-2026-82729Inefficient Algorithmic Complexity vulnerability in elixir-m…6.3
• CVE-2026-8273A weakness has been identified in D-Link DNS-320 2.06B01. Th…7.2
• CVE-2026-82730Incorrect Authorization vulnerability in ash-project ash_typ…8.2
• CVE-2026-82731URL Redirection to Untrusted Site ('Open Redirect') vulnerab…2.3
• CVE-2026-82732Improper Input Validation vulnerability in ash-project ash_t…6.3
• CVE-2026-82733Generation of Error Message Containing Sensitive Information…6.3