CVE-2026-92103

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to make the client hold up to about 16 MiB per connection in frames it should reject, consuming client memory. Mint.HTTP2.Frame.decode_next/2 in lib/mint/http2/frame.ex compares a frame with the client's max_frame_size (16,384 bytes by default) only once the whole declared payload has arrived. Until then it returns :more, and Mint.HTTP2 keeps every received byte in the connection buffer. A server can declare a frame length of up to 16,777,215 bytes and withhold the last byte, keeping roughly 1,024 times the advertised limit buffered for as long as the connection stays open. The server has to send every byte the client buffers, so there is no amplification, and the buffer stops at the 24-bit frame length limit. This issue affects mint: from 0.1.0 before 1.10.2.

• CWE-770

• https://cna.erlef.org/cves/CVE-2026-92103.html
• https://github.com/elixir-mint/mint/commit/20252ca85065f4d1092aed9ee4ed21841a507dfe
• https://github.com/elixir-mint/mint/commit/44d7ce4755d0444ee415cbcca7ce4942382da4dd
• https://github.com/elixir-mint/mint/commit/596ca4304504be68939c4929e0831557097962b8
• https://github.com/elixir-mint/mint/security/advisories/GHSA-q95c-ccq6-j5j6
• https://osv.dev/vulnerability/EEF-CVE-2026-92103

Published

Sep 28, 2026

Last Modified

Sep 29, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-92081fastify is a fast and low-overhead web framework for Node.js…5.9
• CVE-2026-92082By default, Payara Server does not limit the number of faile…6.3
• CVE-2026-92087@fastify/auth is a Fastify plugin that composes multiple aut…8.1
• CVE-2026-92091A flaw was found in jwcrypto. The JWK.import_key() function …5.9
• CVE-2026-92099The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does…6.5
• CVE-2026-9210Insufficient input validation vulnerability in the listed NE…4.5
• CVE-2026-92106Improper Neutralization of Input During Web Page Generation …2.3
• CVE-2026-9211An unauthenticated user on the local network can gain contro…8.8
• CVE-2026-92114A vulnerability was identified in a2ui-project a2ui up to 0.…5.3
• CVE-2026-9212Insufficient authentication and input validation in the list…8
• CVE-2026-92122Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and ear…8.8
• CVE-2026-92123Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and ear…8.8