8.2 HIGH
- CVSS version (CVSS): 4.0
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Attack Requirement (AT): Present (P)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Vulnerable System Impact Confidentiality (VC): None (N)
- Vulnerable System Impact Integrity (VI): None (N)
- Vulnerable System Impact Availability (VA): High (H)
- Subsequent System Impact Confidentiality (SC): None (N)
- Subsequent System Impact Integrity (SI): None (N)
- Subsequent System Impact Availability (SA): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Attack Requirement (MAT): Present (P)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Vulnerable System Impact Confidentiality (MVC): None (N)
- Modified Vulnerable System Impact Integrity (MVI): None (N)
- Modified Vulnerable System Impact Availability (MVA): High (H)
- Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
- Modified Subsequent System Impact Integrity (MSI): Negligible (N)
- Modified Subsequent System Impact Availability (MSA): Negligible (N)
- Safety (S): Not Defined (X)
- Automatable (AU): Not Defined (X)
- Recovery (R): Not Defined (X)
- Value Density (V): Not Defined (X)
- Vulnerability Response Effort (RE): Not Defined (X)
- Provider Urgency (U): Not Defined (X)
- Confidentiality Req. (CR): Not Defined (X)
- Integrity Req. (IR): Not Defined (X)
- Availability Req. (AR): Not Defined (X)
- Exploit Maturity (E): Not Defined (X)
Activity log
- Created suggestion
Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS
Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client host and cause a denial of service. Two HTTP/1 response-parser states accumulate server data without any cap. In lib/mint/http1.ex, decode_status_line/4 stores the unconsumed data in conn.buffer when the status line is incomplete, and decode_body/5 does the same for an unterminated chunk-extension line. Both wait for a CRLF the server never has to send, and conn.buffer is prepended to every subsequent socket message. The :max_header_list_size budget is wired only into decode_headers/5 and decode_trailer_headers/4, so neither of these states is covered by it. A malicious server, or one reached through an attacker-controlled redirect or a fetched URL, streams bytes indefinitely until the BEAM node is killed by the operating system out-of-memory handler. The chunk-extension variant is reached after a valid status line and a complete, valid header section, so an intermediary inspecting only headers sees an ordinary 200 response. This issue affects mint: from 0.1.0 before 1.10.0.
References
-
https://github.com/elixir-mint/mint/security/advisories/GHSA-g83f-2j6r-q6m4 relatedvendor-advisoryexploit
Affected products
- <1.10.0
- <19be5558b6a317e271c78666498dd78b151e490a
Matching in nixpkgs
pkgs.mint
Refreshing language for the front-end web
pkgs.mintotp
Minimal TOTP generator
pkgs.fedimint
Federated E-Cash Mint
pkgs.tendermint
Byzantine-Fault Tolerant State Machines. Or Blockchain, for short
pkgs.garmintools
Provides the ability to communicate with the Garmin Forerunner 305 via the USB interface
pkgs.latexminted
Python executable for LaTeX minted package
pkgs.mint-themes
Mint-X and Mint-Y themes for the cinnamon desktop
pkgs.mint-artwork
Artwork for the cinnamon desktop
pkgs.mint-l-theme
Mint-L theme for the Cinnamon desktop
pkgs.marwaita-mint
None
pkgs.mint-cursor-themes
Linux Mint cursor themes
pkgs.haskellPackages.mintty
A reliable way to detect the presence of a MinTTY console on Windows
pkgs.python313Packages.mintotp
Minimal TOTP generator
-
nixos-unstable -
- nixos-unstable-small 0.3.0
pkgs.python314Packages.mintotp
Minimal TOTP generator
-
nixos-unstable -
- nixos-unstable-small 0.3.0
pkgs.octavePackages.optiminterp
Optimal interpolation toolbox for octave
-
nixos-unstable 11.3.0-optiminterp-0.3.7
- nixpkgs-unstable 11.3.0-optiminterp-0.3.7
- nixos-unstable-small 11.3.0-optiminterp-0.3.7
-
nixos-26.05 11.1.0-optiminterp-0.3.7
- nixos-26.05-small 11.1.0-optiminterp-0.3.7
- nixpkgs-26.05-darwin 11.1.0-optiminterp-0.3.7
Package maintainers
-
@dpc Dawid Ciężarkiewicz <dpc@dpc.pw>
-
@romildo José Romildo Malaquias <malaquias@gmail.com>
-
@mkg20001 Maciej Krüger <mkg20001+nix@gmail.com>
-
@bobby285271 Bobby Rong <rjl931189261@126.com>
-
@provokateurin Kate Döen
-
@ravenjoad Raven Hallsby <raven@hallsby.com>
-
@alexfmpe Alexandre Esteves <alexfmpe@proton.me>
-
@lucasew Lucas Eduardo Wendt <lucas59356@gmail.com>