CVE-2026-48862

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48862", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-05-25T20:44:10.697Z", "datePublished": "2026-06-02T14:15:10.591Z", "dateUpdated": "2026-06-02T19:14:09.683Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Mint.HTTP2'"], "packageName": "mint", "packageURL": "pkg:hex/mint", "product": "mint", "programFiles": ["lib/mint/http2.ex"], "programRoutines": [{"name": "'Elixir.Mint.HTTP2':handle_push_promise/3"}, {"name": "'Elixir.Mint.HTTP2':decode_push_promise_headers_and_add_response/5"}], "repo": "https://github.com/elixir-mint/mint", "vendor": "elixir-mint", "versions": [{"lessThan": "1.9.0", "status": "affected", "version": "0.2.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Mint.HTTP2'"], "packageName": "elixir-mint/mint", "packageURL": "pkg:github/elixir-mint/mint", "product": "mint", "programFiles": ["lib/mint/http2.ex"], "programRoutines": [{"name": "'Elixir.Mint.HTTP2':handle_push_promise/3"}, {"name": "'Elixir.Mint.HTTP2':decode_push_promise_headers_and_add_response/5"}], "repo": "https://github.com/elixir-mint/mint.git", "vendor": "elixir-mint", "versions": [{"lessThan": "70b97b6a5209fb288b0e04d8e657dda26c59de67", "status": "affected", "version": "65c6394d05a1b8aa4a7461708c3aa173e8d7a5cf", "versionType": "git"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.9.0", "versionStartIncluding": "0.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "finder", "value": "Peter Ullrich"}, {"lang": "en", "type": "remediation developer", "value": "Eric Meadows-J\u00f6nsson"}, {"lang": "en", "type": "analyst", "value": "Jonatan M\u00e4nnchen / EEF"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint Mint allows attacker-controlled HTTP/2 servers to exhaust memory in a Mint client via PUSH_PROMISE flooding.<p>In <tt>lib/mint/http2.ex</tt>, <tt>'Elixir.Mint.HTTP2':decode_push_promise_headers_and_add_response/5</tt> inserts a <tt>:reserved_remote</tt> entry into <tt>conn.streams</tt> for every promised stream ID. The neighbouring <tt>'Elixir.Mint.HTTP2':assert_valid_promised_stream_id/2</tt> only verifies that the promised ID is even and not already present; <tt>client_settings.max_concurrent_streams</tt> is not consulted at promise time. The concurrency cap is only checked when the response <tt>HEADERS</tt> for the promised stream arrive, so a server that emits <tt>PUSH_PROMISE</tt> frames and withholds the matching <tt>HEADERS</tt> never trips that check.</p><p>HTTP/2 server push is accepted by default (<tt>client_settings.enable_push</tt> defaults to <tt>true</tt>). A single long-lived HTTP/2 connection to a hostile server lets that server pin one <tt>conn.streams</tt> entry per <tt>PUSH_PROMISE</tt> frame it sends, with no upper bound, until the client process runs out of memory.</p><p>This issue affects mint: from 0.2.0 before 1.9.0.</p>"}], "value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint Mint allows attacker-controlled HTTP/2 servers to exhaust memory in a Mint client via PUSH_PROMISE flooding.\n\nIn lib/mint/http2.ex, Mint.HTTP2.decode_push_promise_headers_and_add_response/5 inserts a :reserved_remote entry into conn.streams for every promised stream ID. The neighbouring Mint.HTTP2.assert_valid_promised_stream_id/2 only verifies that the promised ID is even and not already present; client_settings.max_concurrent_streams is not consulted at promise time. The concurrency cap is only checked when the response HEADERS for the promised stream arrive, so a server that emits PUSH_PROMISE frames and withholds the matching HEADERS never trips that check.\n\nHTTP/2 server push is accepted by default (client_settings.enable_push defaults to true). A single long-lived HTTP/2 connection to a hostile server lets that server pin one conn.streams entry per PUSH_PROMISE frame it sends, with no upper bound, until the client process runs out of memory.\n\nThis issue affects mint: from 0.2.0 before 1.9.0."}], "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130 Excessive Allocation"}]}], "metrics": [{"cvssV4_0": {"attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 8.2, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-06-02T19:14:09.683Z"}, "references": [{"tags": ["vendor-advisory", "related"], "url": "https://github.com/elixir-mint/mint/security/advisories/GHSA-g586-ccqf-7x4r"}, {"tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-48862.html"}, {"tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48862"}, {"tags": ["patch"], "url": "https://github.com/elixir-mint/mint/commit/70b97b6a5209fb288b0e04d8e657dda26c59de67"}], "source": {"discovery": "EXTERNAL"}, "title": "Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrency", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Disable HTTP/2 server push on connections to untrusted servers by passing <tt>client_settings: [enable_push: false]</tt> to <tt>'Elixir.Mint.HTTP':connect/4</tt>. This makes Mint reject any inbound <tt>PUSH_PROMISE</tt> frame with a <tt>PROTOCOL_ERROR</tt> before the vulnerable code path is reached.</p>"}], "value": "Disable HTTP/2 server push on connections to untrusted servers by passing client_settings: [enable_push: false] to Mint.HTTP.connect/4. This makes Mint reject any inbound PUSH_PROMISE frame with a PROTOCOL_ERROR before the vulnerable code path is reached."}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"references": [{"url": "https://github.com/elixir-mint/mint/security/advisories/GHSA-g586-ccqf-7x4r", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-02T18:11:00.524487Z", "id": "CVE-2026-48862", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-02T18:11:05.599Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48862", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-02T18:11:00.524487Z"}}}], "references": [{"url": "https://github.com/elixir-mint/mint/security/advisories/GHSA-g586-ccqf-7x4r", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-02T18:10:50.687Z"}}], "cna": {"title": "Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrency", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Peter Ullrich"}, {"lang": "en", "type": "remediation developer", "value": "Eric Meadows-J\u00f6nsson"}, {"lang": "en", "type": "analyst", "value": "Jonatan M\u00e4nnchen / EEF"}], "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130 Excessive Allocation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*"], "repo": "https://github.com/elixir-mint/mint", "vendor": "elixir-mint", "modules": ["'Elixir.Mint.HTTP2'"], "product": "mint", "versions": [{"status": "affected", "version": "0.2.0", "lessThan": "1.9.0", "versionType": "semver"}], "packageURL": "pkg:hex/mint", "packageName": "mint", "programFiles": ["lib/mint/http2.ex"], "collectionURL": "https://repo.hex.pm", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Mint.HTTP2':handle_push_promise/3"}, {"name": "'Elixir.Mint.HTTP2':decode_push_promise_headers_and_add_response/5"}]}, {"cpes": ["cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*"], "repo": "https://github.com/elixir-mint/mint.git", "vendor": "elixir-mint", "modules": ["'Elixir.Mint.HTTP2'"], "product": "mint", "versions": [{"status": "affected", "version": "65c6394d05a1b8aa4a7461708c3aa173e8d7a5cf", "lessThan": "70b97b6a5209fb288b0e04d8e657dda26c59de67", "versionType": "git"}], "packageURL": "pkg:github/elixir-mint/mint", "packageName": "elixir-mint/mint", "programFiles": ["lib/mint/http2.ex"], "collectionURL": "https://github.com", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Mint.HTTP2':handle_push_promise/3"}, {"name": "'Elixir.Mint.HTTP2':decode_push_promise_headers_and_add_response/5"}]}], "references": [{"url": "https://github.com/elixir-mint/mint/security/advisories/GHSA-g586-ccqf-7x4r", "tags": ["vendor-advisory", "related"]}, {"url": "https://cna.erlef.org/cves/CVE-2026-48862.html", "tags": ["related"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-48862", "tags": ["related"]}, {"url": "https://github.com/elixir-mint/mint/commit/70b97b6a5209fb288b0e04d8e657dda26c59de67", "tags": ["patch"]}], "workarounds": [{"lang": "en", "value": "Disable HTTP/2 server push on connections to untrusted servers by passing client_settings: [enable_push: false] to Mint.HTTP.connect/4. This makes Mint reject any inbound PUSH_PROMISE frame with a PROTOCOL_ERROR before the vulnerable code path is reached.", "supportingMedia": [{"type": "text/html", "value": "<p>Disable HTTP/2 server push on connections to untrusted servers by passing <tt>client_settings: [enable_push: false]</tt> to <tt>'Elixir.Mint.HTTP':connect/4</tt>. This makes Mint reject any inbound <tt>PUSH_PROMISE</tt> frame with a <tt>PROTOCOL_ERROR</tt> before the vulnerable code path is reached.</p>", "base64": false}]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint Mint allows attacker-controlled HTTP/2 servers to exhaust memory in a Mint client via PUSH_PROMISE flooding.\n\nIn lib/mint/http2.ex, Mint.HTTP2.decode_push_promise_headers_and_add_response/5 inserts a :reserved_remote entry into conn.streams for every promised stream ID. The neighbouring Mint.HTTP2.assert_valid_promised_stream_id/2 only verifies that the promised ID is even and not already present; client_settings.max_concurrent_streams is not consulted at promise time. The concurrency cap is only checked when the response HEADERS for the promised stream arrive, so a server that emits PUSH_PROMISE frames and withholds the matching HEADERS never trips that check.\n\nHTTP/2 server push is accepted by default (client_settings.enable_push defaults to true). A single long-lived HTTP/2 connection to a hostile server lets that server pin one conn.streams entry per PUSH_PROMISE frame it sends, with no upper bound, until the client process runs out of memory.\n\nThis issue affects mint: from 0.2.0 before 1.9.0.", "supportingMedia": [{"type": "text/html", "value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint Mint allows attacker-controlled HTTP/2 servers to exhaust memory in a Mint client via PUSH_PROMISE flooding.<p>In <tt>lib/mint/http2.ex</tt>, <tt>'Elixir.Mint.HTTP2':decode_push_promise_headers_and_add_response/5</tt> inserts a <tt>:reserved_remote</tt> entry into <tt>conn.streams</tt> for every promised stream ID. The neighbouring <tt>'Elixir.Mint.HTTP2':assert_valid_promised_stream_id/2</tt> only verifies that the promised ID is even and not already present; <tt>client_settings.max_concurrent_streams</tt> is not consulted at promise time. The concurrency cap is only checked when the response <tt>HEADERS</tt> for the promised stream arrive, so a server that emits <tt>PUSH_PROMISE</tt> frames and withholds the matching <tt>HEADERS</tt> never trips that check.</p><p>HTTP/2 server push is accepted by default (<tt>client_settings.enable_push</tt> defaults to <tt>true</tt>). A single long-lived HTTP/2 connection to a hostile server lets that server pin one <tt>conn.streams</tt> entry per <tt>PUSH_PROMISE</tt> frame it sends, with no upper bound, until the client process runs out of memory.</p><p>This issue affects mint: from 0.2.0 before 1.9.0.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.9.0", "versionStartIncluding": "0.2.0"}], "operator": "OR"}], "operator": "AND"}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-06-02T19:14:09.683Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48862", "state": "PUBLISHED", "dateUpdated": "2026-06-02T19:14:09.683Z", "dateReserved": "2026-05-25T20:44:10.697Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-06-02T14:15:10.591Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Mint.HTTP2'"], "packageName": "mint", "packageURL": "pkg:hex/mint", "product": "mint", "programFiles": ["lib/mint/http2.ex"], "programRoutines": [{"name": "'Elixir.Mint.HTTP2':handle_push_promise/3"}, {"name": "'Elixir.Mint.HTTP2':decode_push_promise_headers_and_add_response/5"}], "repo": "https://github.com/elixir-mint/mint", "vendor": "elixir-mint", "versions": [{"lessThan": "1.9.0", "status": "affected", "version": "0.2.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Mint.HTTP2'"], "packageName": "elixir-mint/mint", "packageURL": "pkg:github/elixir-mint/mint", "product": "mint", "programFiles": ["lib/mint/http2.ex"], "programRoutines": [{"name": "'Elixir.Mint.HTTP2':handle_push_promise/3"}, {"name": "'Elixir.Mint.HTTP2':decode_push_promise_headers_and_add_response/5"}], "repo": "https://github.com/elixir-mint/mint.git", "vendor": "elixir-mint", "versions": [{"lessThan": "70b97b6a5209fb288b0e04d8e657dda26c59de67", "status": "affected", "version": "65c6394d05a1b8aa4a7461708c3aa173e8d7a5cf", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint Mint allows attacker-controlled HTTP/2 servers to exhaust memory in a Mint client via PUSH_PROMISE flooding.\n\nIn lib/mint/http2.ex, Mint.HTTP2.decode_push_promise_headers_and_add_response/5 inserts a :reserved_remote entry into conn.streams for every promised stream ID. The neighbouring Mint.HTTP2.assert_valid_promised_stream_id/2 only verifies that the promised ID is even and not already present; client_settings.max_concurrent_streams is not consulted at promise time. The concurrency cap is only checked when the response HEADERS for the promised stream arrive, so a server that emits PUSH_PROMISE frames and withholds the matching HEADERS never trips that check.\n\nHTTP/2 server push is accepted by default (client_settings.enable_push defaults to true). A single long-lived HTTP/2 connection to a hostile server lets that server pin one conn.streams entry per PUSH_PROMISE frame it sends, with no upper bound, until the client process runs out of memory.\n\nThis issue affects mint: from 0.2.0 before 1.9.0."}, {"lang": "es", "value": "Vulnerabilidad de asignaci\u00f3n de recursos sin l\u00edmites ni limitaci\u00f3n en elixir-mint Mint permite a servidores HTTP/2 controlados por atacantes agotar la memoria en un cliente Mint mediante inundaci\u00f3n de PUSH_PROMISE.\n\nEn lib/mint/http2.ex, Mint.HTTP2.decode_push_promise_headers_and_add_response/5 inserta una entrada :reserved_remote en conn.streams para cada ID de flujo prometido. La funci\u00f3n adyacente Mint.HTTP2.assert_valid_promised_stream_id/2 solo verifica que el ID prometido sea par y no est\u00e9 ya presente; client_settings.max_concurrent_streams no se consulta en el momento de la promesa. El l\u00edmite de concurrencia solo se verifica cuando llegan los HEADERS de respuesta para el flujo prometido, por lo que un servidor que emite tramas PUSH_PROMISE y retiene los HEADERS coincidentes nunca activa esa verificaci\u00f3n.\n\nEl env\u00edo de servidor HTTP/2 se acepta por defecto (client_settings.enable_push por defecto es true). Una \u00fanica conexi\u00f3n HTTP/2 de larga duraci\u00f3n a un servidor hostil permite a ese servidor fijar una entrada conn.streams por cada trama PUSH_PROMISE que env\u00eda, sin l\u00edmite superior, hasta que el proceso del cliente se quede sin memoria.\n\nEste problema afecta a mint: desde 0.2.0 antes de 1.9.0."}], "id": "CVE-2026-48862", "lastModified": "2026-07-22T19:10:00.120", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48862", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-02T18:11:00.524487Z", "version": "2.0.3"}}]}, "published": "2026-06-02T16:16:44.627", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://cna.erlef.org/cves/CVE-2026-48862.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/elixir-mint/mint/commit/70b97b6a5209fb288b0e04d8e657dda26c59de67"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/elixir-mint/mint/security/advisories/GHSA-g586-ccqf-7x4r"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48862"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/elixir-mint/mint/security/advisories/GHSA-g586-ccqf-7x4r"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.2.0,1.9.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "mint", "source": "cna", "vendor": "elixir-mint"}, "product": "mint", "vendor": "elixir-mint"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[65c6394d05a1b8aa4a7461708c3aa173e8d7a5cf,70b97b6a5209fb288b0e04d8e657dda26c59de67)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "mint", "source": "cna", "vendor": "elixir-mint"}, "product": "mint", "vendor": "elixir-mint"}], "created": "2026-06-02T17:15:18.999439+00:00", "updated": "2026-06-02T20:51:05.781206+00:00", "vendors": ["elixir-mint", "elixir-mint$PRODUCT$mint"]}