Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size (CVE-2026-92103) | HOL Guard CVE

Medium · CVSS 6.3CVE-2026-92103

Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size

Answer in brief

CVE-2026-92103 records a Medium severity (CVSS 6.3) vulnerability in Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size. The current sources do not mark it as known exploited. The current feed maps elixir-mint/elixir-mint/mint (generic), elixir-mint/mint (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 28, 2026Updated Sep 28, 2026Source checked Sep 28, 2026First seen by HOL Sep 28, 2026Material review Sep 28, 2026

Upstream Advisory

Key facts

Risk: Medium · CVSS 6.3
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

CVSS is 6.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps elixir-mint/elixir-mint/mint (generic), elixir-mint/mint (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
elixir-mint/elixir-mint/mintgeneric	>=596ca4304504be68939c4929e0831557097962b8 <20252ca85065f4d1092aed9ee4ed21841a507dfe	20252ca85065f4d1092aed9ee4ed21841a507dfe
elixir-mint/mintgeneric	>=0.1.0 <1.11.0	1.11.0

Recommended response

Check inventory. Check lockfiles and deployed manifests for elixir-mint/elixir-mint/mint, elixir-mint/mint.
Review the reported fix. Source-reported workaround: Connect to untrusted origins over HTTP/1 only, with protocols: [:http1] in Mint.HTTP.connect/4, which never runs the HTTP/2 frame decoder. Finch and Req pools use HTTP/1 only unless :http2 is added to their protocols option.

Evidence timeline and material changes

Published upstream
Sep 28, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 28, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 28, 2026

Sources and claim methodology

Upstream source description

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to make the client hold up to about 16 MiB per connection in frames it should reject, consuming client memory. Mint.HTTP2.Frame.decode_next/2 in lib/mint/http2/frame.ex compares a frame with the client's max_frame_size (16,384 bytes by default) only once the whole declared payload has arrived. Until then it returns :more, and Mint.HTTP2 keeps every received byte in the connection buffer. A server can declare a frame length of up to 16,777,215 bytes and withhold the last byte, keeping roughly 1,024 times the advertised limit buffered for as long as the connection stays open. The server has to send every byte the client buffers, so there is no amplification, and the buffer stops at the 24-bit frame length limit. This issue affects mint: from 0.1.0 before 1.11.0.

Quoted source text, attributed separately from HOL analysis.