CVE-2026-48862

Estado: AplazadaAlta (8.2)—

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint Mint allows attacker-controlled HTTP/2 servers to exhaust memory in a Mint client via PUSH_PROMISE flooding.

In lib/mint/http2.ex, Mint.HTTP2.decode_push_promise_headers_and_add_response/5 inserts a :reserved_remote entry into conn.streams for every promised stream ID. The neighbouring Mint.HTTP2.assert_valid_promised_stream_id/2 only verifies that the promised ID is even and not already present; client_settings.max_concurrent_streams is not consulted at promise time. The concurrency cap is only checked when the response HEADERS for the promised stream arrive, so a server that emits PUSH_PROMISE frames and withholds the matching HEADERS never trips that check.

Leer descripción completaMostrar menos

HTTP/2 server push is accepted by default (client_settings.enable_push defaults to true). A single long-lived HTTP/2 connection to a hostile server lets that server pin one conn.streams entry per PUSH_PROMISE frame it sends, with no upper bound, until the client process runs out of memory.

This issue affects mint: from 0.2.0 before 1.9.0.

CVSS

Versión: 4.0
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Puntuación base: 8.2

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.52%
Percentil entre todas las CVEs puntuadas: 42
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access85 %
Impacto principalT1499.004 Application or System Exploitationimpact90 %
Impacto secundarioT1068 Exploitation for Privilege Escalationprivilege escalation65 %

Servidor HTTP/2 hostil explota vulnerabilidad en cliente Mint (AV:N, PR:N, UI:N); PUSH_PROMISE flooding causa agotamiento de memoria sin límites, típico DoS de aplicación (CWE-770). Impacto secundario: si cliente corre en contexto privilegiado, consumo extremo de recursos puede escalar.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network Traffic Application Isolation and Sandboxing Exploit Protection Update Software Vulnerability Scanning Threat Intelligence Program

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Elixir-mint — Mint^AI

CWE

CWE-770

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-48862",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-48862",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-02T18:11:00.524487Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 8.2,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*"
          ],
          "repo": "https://github.com/elixir-mint/mint",
          "vendor": "elixir-mint",
          "modules": [
            "'Elixir.Mint.HTTP2'"
          ],
          "product": "mint",
          "versions": [
            {
              "status": "affected",
              "version": "0.2.0",
              "lessThan": "1.9.0",
              "versionType": "semver"
            }
          ],
          "packageURL": "pkg:hex/mint",
          "packageName": "mint",
          "programFiles": [
            "lib/mint/http2.ex"
          ],
          "collectionURL": "https://repo.hex.pm",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "'Elixir.Mint.HTTP2':handle_push_promise/3"
            },
            {
              "name": "'Elixir.Mint.HTTP2':decode_push_promise_headers_and_add_response/5"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*"
          ],
          "repo": "https://github.com/elixir-mint/mint.git",
          "vendor": "elixir-mint",
          "modules": [
            "'Elixir.Mint.HTTP2'"
          ],
          "product": "mint",
          "versions": [
            {
              "status": "affected",
              "version": "65c6394d05a1b8aa4a7461708c3aa173e8d7a5cf",
              "lessThan": "70b97b6a5209fb288b0e04d8e657dda26c59de67",
              "versionType": "git"
            }
          ],
          "packageURL": "pkg:github/elixir-mint/mint",
          "packageName": "elixir-mint/mint",
          "programFiles": [
            "lib/mint/http2.ex"
          ],
          "collectionURL": "https://github.com",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "'Elixir.Mint.HTTP2':handle_push_promise/3"
            },
            {
              "name": "'Elixir.Mint.HTTP2':decode_push_promise_headers_and_add_response/5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-06-02T16:16:44.627",
  "references": [
    {
      "url": "https://cna.erlef.org/cves/CVE-2026-48862.html",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/elixir-mint/mint/commit/70b97b6a5209fb288b0e04d8e657dda26c59de67",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/elixir-mint/mint/security/advisories/GHSA-g586-ccqf-7x4r",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48862",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/elixir-mint/mint/security/advisories/GHSA-g586-ccqf-7x4r",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint Mint allows attacker-controlled HTTP/2 servers to exhaust memory in a Mint client via PUSH_PROMISE flooding.\n\nIn lib/mint/http2.ex, Mint.HTTP2.decode_push_promise_headers_and_add_response/5 inserts a :reserved_remote entry into conn.streams for every promised stream ID. The neighbouring Mint.HTTP2.assert_valid_promised_stream_id/2 only verifies that the promised ID is even and not already present; client_settings.max_concurrent_streams is not consulted at promise time. The concurrency cap is only checked when the response HEADERS for the promised stream arrive, so a server that emits PUSH_PROMISE frames and withholds the matching HEADERS never trips that check.\n\nHTTP/2 server push is accepted by default (client_settings.enable_push defaults to true). A single long-lived HTTP/2 connection to a hostile server lets that server pin one conn.streams entry per PUSH_PROMISE frame it sends, with no upper bound, until the client process runs out of memory.\n\nThis issue affects mint: from 0.2.0 before 1.9.0."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de asignación de recursos sin límites ni limitación en elixir-mint Mint permite a servidores HTTP/2 controlados por atacantes agotar la memoria en un cliente Mint mediante inundación de PUSH_PROMISE.\n\nEn lib/mint/http2.ex, Mint.HTTP2.decode_push_promise_headers_and_add_response/5 inserta una entrada :reserved_remote en conn.streams para cada ID de flujo prometido. La función adyacente Mint.HTTP2.assert_valid_promised_stream_id/2 solo verifica que el ID prometido sea par y no esté ya presente; client_settings.max_concurrent_streams no se consulta en el momento de la promesa. El límite de concurrencia solo se verifica cuando llegan los HEADERS de respuesta para el flujo prometido, por lo que un servidor que emite tramas PUSH_PROMISE y retiene los HEADERS coincidentes nunca activa esa verificación.\n\nEl envío de servidor HTTP/2 se acepta por defecto (client_settings.enable_push por defecto es true). Una única conexión HTTP/2 de larga duración a un servidor hostil permite a ese servidor fijar una entrada conn.streams por cada trama PUSH_PROMISE que envía, sin límite superior, hasta que el proceso del cliente se quede sin memoria.\n\nEste problema afecta a mint: desde 0.2.0 antes de 1.9.0."
    }
  ],
  "lastModified": "2026-07-22T19:10:00.120",
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
}