CVE-2026-48862: Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrency

Synopsis

This is an allocation-without-limits vulnerability in the Mint HTTP/2 client library for Elixir. An attacker-controlled HTTP/2 server can flood a connecting Mint client with PUSH_PROMISE frames, each of which adds an unbounded entry to the client's in-memory stream table, because the client never enforces its max_concurrent_streams cap at promise time. Successful exploitation exhausts the heap of the Elixir process running the Mint client, causing a denial of service. A patched-image rebuild at version 1.9.0 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must operate or control an HTTP/2 server that the target Mint client connects to over the network; the exploit is delivered through that server-to-client connection.

• AuthenticationNot required

  No authentication or credentials are needed; any Mint client that opens a connection to the hostile server is immediately exposed.

• Victim interactionNot required

  No user action beyond the existing HTTP/2 connection is needed; the server can flood PUSH_PROMISE frames as soon as the connection is established.

• Attack complexityDetail

  The exploit is straightforward and condition-free once a connection exists, though the CVSS vector notes an attack-requirements token (AT:P), indicating the attacker must be in a position to operate or intercept as the target's HTTP/2 server.

Blast Radius

• The Elixir process running the Mint client exhausts available heap memory as the conn.streams map grows without bound.
• The affected client process crashes or becomes unresponsive, severing any in-flight HTTP/2 requests it was handling.
• If the Mint client is part of a connection pool or a long-running service, the crash can take down that service process, disrupting downstream application functionality for as long as the process remains down.