CVE-2026-58226 Unauthenticated denial-of-service via unbounded HPACK integer decoding in hpax

What is CVE-2026-58226?

CVE-2026-58226 is a high-severity denial of service vulnerability in elixir-mint hpax, published on 6 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Inefficient Algorithmic Complexity vulnerability in elixir-mint hpax allows unauthenticated denial-of-service via unbounded HPACK integer decoding.

hpax decodes HPACK variable-length integers with no upper bound on the decoded value or the number of continuation octets. 'Elixir.HPAX.Types':decode_remaining_integer/3 accumulates the integer as int + (value <<< m), shifting by 7 more bits for each continuation octet and stopping only on a terminating octet or truncated input, never because the integer grew too large. Because BEAM integers are arbitrary precision, a run of N continuation octets builds an O(N)-bit bignum and re-adds into an ever-larger bignum on each step, so the total decoding cost is superlinear (about O(N^2)). An unauthenticated attacker who can send an HTTP/2 header block to a server using this decoder (reached through the 'Elixir.HPAX':decode/2 entry point) can supply a small header block that forces a large, attacker-controlled amount of CPU (and transient memory), a denial-of-service amplification.

This issue affects hpax from 0.1.1 before 1.0.4.

Weakness: CWE-407

Which versions are affected by CVE-2026-58226?

1 open source package ship an affected version, including hpax.

How do I fix CVE-2026-58226?

Upgrade hpax to 1.0.4 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-58226 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-58226 exists.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as EEF-CVE-2026-58226, GHSA-jj2p-32j7-whj2.