CVE-2026-92103 Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size
A malicious HTTP/2 server can cause memory exhaustion in the Mint Elixir client by sending oversized frames that are buffered before size validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-92103?
CVE-2026-92103 is a medium-severity denial of service vulnerability in elixir-mint mint, published on 28 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to make the client hold up to about 16 MiB per connection in frames it should reject, consuming client memory.
Mint.HTTP2.Frame.decode_next/2 in lib/mint/http2/frame.ex compares a frame with the client's max_frame_size (16,384 bytes by default) only once the whole declared payload has arrived. Until then it returns :more, and Mint.HTTP2 keeps every received byte in the connection buffer. A server can declare a frame length of up to 16,777,215 bytes and withhold the last byte, keeping roughly 1,024 times the advertised limit buffered for as long as the connection stays open. The server has to send every byte the client buffers, so there is no amplification, and the buffer stops at the 24-bit frame length limit.
This issue affects mint: from 0.1.0 before 1.10.2.
Weakness: CWE-770
Which versions are affected by CVE-2026-92103?
1 open source package ship an affected version, including mint.
| Package | Affected | Fixed in |
|---|---|---|
mint Hex | From 0.1.0 | 1.10.2 |
How do I fix CVE-2026-92103?
Upgrade mint to 1.10.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-92103 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-92103 exists.
Sources
Also known as EEF-CVE-2026-92103, GHSA-q95c-ccq6-j5j6.