CVE-2026-56810

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-56810", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-06-23T12:29:02.507Z", "datePublished": "2026-07-06T09:17:17.429Z", "dateUpdated": "2026-07-07T04:32:36.390Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Mint.HTTP1'"], "packageName": "mint", "packageURL": "pkg:hex/mint", "product": "mint", "programFiles": ["lib/mint/http1.ex"], "programRoutines": [{"name": "'Elixir.Mint.HTTP1':decode_body/5"}, {"name": "'Elixir.Mint.HTTP1':add_body_to_buffer/2"}], "repo": "https://github.com/elixir-mint/mint", "vendor": "elixir-mint", "versions": [{"lessThan": "1.9.1", "status": "affected", "version": "0.5.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Mint.HTTP1'"], "packageName": "elixir-mint/mint", "packageURL": "pkg:github/elixir-mint/mint", "product": "mint", "programFiles": ["lib/mint/http1.ex"], "programRoutines": [{"name": "'Elixir.Mint.HTTP1':decode_body/5"}, {"name": "'Elixir.Mint.HTTP1':add_body_to_buffer/2"}], "repo": "https://github.com/elixir-mint/mint", "vendor": "elixir-mint", "versions": [{"lessThan": "193ce714907d16e8adc4ab3c40e4f0c2f045b2a6", "status": "affected", "version": "c575d819d39ebf7e9b77ec24584a5ffbb11c844e", "versionType": "git"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.9.1", "versionStartIncluding": "0.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "finder", "value": "Peter Ullrich"}, {"lang": "en", "type": "remediation developer", "value": "Andrea Leopardi"}, {"lang": "en", "type": "analyst", "value": "Jonatan M\u00e4nnchen / EEF"}, {"lang": "en", "type": "analyst", "value": "Eric Meadows-J\u00f6nsson"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint (<tt>Mint.HTTP1</tt> module) allows a denial of service via an oversized <tt>chunked</tt> transfer-encoded response.</p><p>This vulnerability is associated with program files <tt>lib/mint/http1.ex</tt> and program routines <tt>'Elixir.Mint.HTTP1':decode_body/5</tt>, <tt>'Elixir.Mint.HTTP1':add_body_to_buffer/2</tt>.</p><p>When Mint decodes a <tt>chunked</tt> HTTP response body, it accumulates each partial fragment of the current chunk in the connection's <tt>data_buffer</tt> (an unbounded iolist) via <tt>add_body_to_buffer/2</tt> and does not emit the data to the caller until the full declared chunk length has been received. The chunk size is taken directly from the server and parsed with no upper bound, so a malicious or compromised server can announce one enormous chunk (for example a size line of <tt>7FFFFFFF</tt>, about 2 GiB) and then send the body bytes slowly without ever completing the chunk. The client buffers every received byte while it waits for a completion that never arrives, and because no data responses are produced until the chunk finishes, a caller that otherwise streams large <tt>content-length</tt> bodies safely gains no protection. An unauthenticated remote server (reachable whenever a client follows redirects, fetches user-supplied URLs, or processes webhooks) can drive the client's memory arbitrarily high and trigger an out-of-memory condition.</p><p>This issue affects mint: from 0.5.0 before 1.9.1.</p>"}], "value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint (Mint.HTTP1 module) allows a denial of service via an oversized chunked transfer-encoded response.\n\nThis vulnerability is associated with program files lib/mint/http1.ex and program routines 'Elixir.Mint.HTTP1':decode_body/5, 'Elixir.Mint.HTTP1':add_body_to_buffer/2.\n\nWhen Mint decodes a chunked HTTP response body, it accumulates each partial fragment of the current chunk in the connection's data_buffer (an unbounded iolist) via add_body_to_buffer/2 and does not emit the data to the caller until the full declared chunk length has been received. The chunk size is taken directly from the server and parsed with no upper bound, so a malicious or compromised server can announce one enormous chunk (for example a size line of 7FFFFFFF, about 2 GiB) and then send the body bytes slowly without ever completing the chunk. The client buffers every received byte while it waits for a completion that never arrives, and because no data responses are produced until the chunk finishes, a caller that otherwise streams large content-length bodies safely gains no protection. An unauthenticated remote server (reachable whenever a client follows redirects, fetches user-supplied URLs, or processes webhooks) can drive the client's memory arbitrarily high and trigger an out-of-memory condition.\n\nThis issue affects mint: from 0.5.0 before 1.9.1."}], "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130 Excessive Allocation"}]}], "metrics": [{"cvssV4_0": {"attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-07-07T04:32:36.390Z"}, "references": [{"tags": ["vendor-advisory", "related"], "url": "https://github.com/elixir-mint/mint/security/advisories/GHSA-c59h-fq4p-r36r"}, {"tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-56810.html"}, {"tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-56810"}, {"tags": ["patch"], "url": "https://github.com/elixir-mint/mint/commit/193ce714907d16e8adc4ab3c40e4f0c2f045b2a6"}], "source": {"discovery": "EXTERNAL"}, "title": "mint buffers an entire chunked response chunk in memory in Mint.HTTP1.decode_body/5", "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"references": [{"url": "https://github.com/elixir-mint/mint/security/advisories/GHSA-c59h-fq4p-r36r", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-06T15:52:57.089606Z", "id": "CVE-2026-56810", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-06T15:53:00.170Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-56810", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-06T15:52:57.089606Z"}}}], "references": [{"url": "https://github.com/elixir-mint/mint/security/advisories/GHSA-c59h-fq4p-r36r", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-06T15:52:34.290Z"}}], "cna": {"title": "mint buffers an entire chunked response chunk in memory in Mint.HTTP1.decode_body/5", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Peter Ullrich"}, {"lang": "en", "type": "remediation developer", "value": "Andrea Leopardi"}, {"lang": "en", "type": "analyst", "value": "Jonatan M\u00e4nnchen / EEF"}, {"lang": "en", "type": "analyst", "value": "Eric Meadows-J\u00f6nsson"}], "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130 Excessive Allocation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*"], "repo": "https://github.com/elixir-mint/mint", "vendor": "elixir-mint", "modules": ["'Elixir.Mint.HTTP1'"], "product": "mint", "versions": [{"status": "affected", "version": "0.5.0", "lessThan": "1.9.1", "versionType": "semver"}], "packageURL": "pkg:hex/mint", "packageName": "mint", "programFiles": ["lib/mint/http1.ex"], "collectionURL": "https://repo.hex.pm", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Mint.HTTP1':decode_body/5"}, {"name": "'Elixir.Mint.HTTP1':add_body_to_buffer/2"}]}, {"cpes": ["cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*"], "repo": "https://github.com/elixir-mint/mint", "vendor": "elixir-mint", "modules": ["'Elixir.Mint.HTTP1'"], "product": "mint", "versions": [{"status": "affected", "version": "c575d819d39ebf7e9b77ec24584a5ffbb11c844e", "lessThan": "193ce714907d16e8adc4ab3c40e4f0c2f045b2a6", "versionType": "git"}], "packageURL": "pkg:github/elixir-mint/mint", "packageName": "elixir-mint/mint", "programFiles": ["lib/mint/http1.ex"], "collectionURL": "https://github.com", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Mint.HTTP1':decode_body/5"}, {"name": "'Elixir.Mint.HTTP1':add_body_to_buffer/2"}]}], "references": [{"url": "https://github.com/elixir-mint/mint/security/advisories/GHSA-c59h-fq4p-r36r", "tags": ["vendor-advisory", "related"]}, {"url": "https://cna.erlef.org/cves/CVE-2026-56810.html", "tags": ["related"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-56810", "tags": ["related"]}, {"url": "https://github.com/elixir-mint/mint/commit/193ce714907d16e8adc4ab3c40e4f0c2f045b2a6", "tags": ["patch"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint (Mint.HTTP1 module) allows a denial of service via an oversized chunked transfer-encoded response.\n\nThis vulnerability is associated with program files lib/mint/http1.ex and program routines 'Elixir.Mint.HTTP1':decode_body/5, 'Elixir.Mint.HTTP1':add_body_to_buffer/2.\n\nWhen Mint decodes a chunked HTTP response body, it accumulates each partial fragment of the current chunk in the connection's data_buffer (an unbounded iolist) via add_body_to_buffer/2 and does not emit the data to the caller until the full declared chunk length has been received. The chunk size is taken directly from the server and parsed with no upper bound, so a malicious or compromised server can announce one enormous chunk (for example a size line of 7FFFFFFF, about 2 GiB) and then send the body bytes slowly without ever completing the chunk. The client buffers every received byte while it waits for a completion that never arrives, and because no data responses are produced until the chunk finishes, a caller that otherwise streams large content-length bodies safely gains no protection. An unauthenticated remote server (reachable whenever a client follows redirects, fetches user-supplied URLs, or processes webhooks) can drive the client's memory arbitrarily high and trigger an out-of-memory condition.\n\nThis issue affects mint: from 0.5.0 before 1.9.1.", "supportingMedia": [{"type": "text/html", "value": "<p>Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint (<tt>Mint.HTTP1</tt> module) allows a denial of service via an oversized <tt>chunked</tt> transfer-encoded response.</p><p>This vulnerability is associated with program files <tt>lib/mint/http1.ex</tt> and program routines <tt>'Elixir.Mint.HTTP1':decode_body/5</tt>, <tt>'Elixir.Mint.HTTP1':add_body_to_buffer/2</tt>.</p><p>When Mint decodes a <tt>chunked</tt> HTTP response body, it accumulates each partial fragment of the current chunk in the connection's <tt>data_buffer</tt> (an unbounded iolist) via <tt>add_body_to_buffer/2</tt> and does not emit the data to the caller until the full declared chunk length has been received. The chunk size is taken directly from the server and parsed with no upper bound, so a malicious or compromised server can announce one enormous chunk (for example a size line of <tt>7FFFFFFF</tt>, about 2 GiB) and then send the body bytes slowly without ever completing the chunk. The client buffers every received byte while it waits for a completion that never arrives, and because no data responses are produced until the chunk finishes, a caller that otherwise streams large <tt>content-length</tt> bodies safely gains no protection. An unauthenticated remote server (reachable whenever a client follows redirects, fetches user-supplied URLs, or processes webhooks) can drive the client's memory arbitrarily high and trigger an out-of-memory condition.</p><p>This issue affects mint: from 0.5.0 before 1.9.1.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.9.1", "versionStartIncluding": "0.5.0"}], "operator": "OR"}], "operator": "AND"}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-07-07T04:32:36.390Z"}}}, "cveMetadata": {"cveId": "CVE-2026-56810", "state": "PUBLISHED", "dateUpdated": "2026-07-07T04:32:36.390Z", "dateReserved": "2026-06-23T12:29:02.507Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-07-06T09:17:17.429Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Mint.HTTP1'"], "packageName": "mint", "packageURL": "pkg:hex/mint", "product": "mint", "programFiles": ["lib/mint/http1.ex"], "programRoutines": [{"name": "'Elixir.Mint.HTTP1':decode_body/5"}, {"name": "'Elixir.Mint.HTTP1':add_body_to_buffer/2"}], "repo": "https://github.com/elixir-mint/mint", "vendor": "elixir-mint", "versions": [{"lessThan": "1.9.1", "status": "affected", "version": "0.5.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Mint.HTTP1'"], "packageName": "elixir-mint/mint", "packageURL": "pkg:github/elixir-mint/mint", "product": "mint", "programFiles": ["lib/mint/http1.ex"], "programRoutines": [{"name": "'Elixir.Mint.HTTP1':decode_body/5"}, {"name": "'Elixir.Mint.HTTP1':add_body_to_buffer/2"}], "repo": "https://github.com/elixir-mint/mint", "vendor": "elixir-mint", "versions": [{"lessThan": "193ce714907d16e8adc4ab3c40e4f0c2f045b2a6", "status": "affected", "version": "c575d819d39ebf7e9b77ec24584a5ffbb11c844e", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint (Mint.HTTP1 module) allows a denial of service via an oversized chunked transfer-encoded response.\n\nThis vulnerability is associated with program files lib/mint/http1.ex and program routines 'Elixir.Mint.HTTP1':decode_body/5, 'Elixir.Mint.HTTP1':add_body_to_buffer/2.\n\nWhen Mint decodes a chunked HTTP response body, it accumulates each partial fragment of the current chunk in the connection's data_buffer (an unbounded iolist) via add_body_to_buffer/2 and does not emit the data to the caller until the full declared chunk length has been received. The chunk size is taken directly from the server and parsed with no upper bound, so a malicious or compromised server can announce one enormous chunk (for example a size line of 7FFFFFFF, about 2 GiB) and then send the body bytes slowly without ever completing the chunk. The client buffers every received byte while it waits for a completion that never arrives, and because no data responses are produced until the chunk finishes, a caller that otherwise streams large content-length bodies safely gains no protection. An unauthenticated remote server (reachable whenever a client follows redirects, fetches user-supplied URLs, or processes webhooks) can drive the client's memory arbitrarily high and trigger an out-of-memory condition.\n\nThis issue affects mint: from 0.5.0 before 1.9.1."}, {"lang": "es", "value": "Vulnerabilidad de asignaci\u00f3n de recursos sin l\u00edmites o estrangulamiento en elixir-mint mint (m\u00f3dulo Mint.HTTP1) permite una denegaci\u00f3n de servicio a trav\u00e9s de una respuesta codificada por transferencia fragmentada de tama\u00f1o excesivo.\n\nEsta vulnerabilidad est\u00e1 asociada con los archivos de programa lib/mint/http1.ex y las rutinas de programa \u2019Elixir.Mint.HTTP1\u2019:decode_body/5, \u2019Elixir.Mint.HTTP1\u2019:add_body_to_buffer/2.\n\nCuando Mint decodifica un cuerpo de respuesta HTTP fragmentado, acumula cada fragmento parcial del fragmento actual en el data_buffer de la conexi\u00f3n (una iolist ilimitada) a trav\u00e9s de add_body_to_buffer/2 y no emite los datos al llamador hasta que se haya recibido la longitud completa declarada del fragmento. El tama\u00f1o del fragmento se toma directamente del servidor y se analiza sin l\u00edmite superior, por lo que un servidor malicioso o comprometido puede anunciar un fragmento enorme (por ejemplo, una l\u00ednea de tama\u00f1o de 7FFFFFFF, aproximadamente 2 GiB) y luego enviar los bytes del cuerpo lentamente sin completar nunca el fragmento. El cliente almacena en b\u00fafer cada byte recibido mientras espera una finalizaci\u00f3n que nunca llega, y debido a que no se producen respuestas de datos hasta que el fragmento termina, un llamador que de otro modo transmite cuerpos grandes con longitud de contenido de forma segura no obtiene ninguna protecci\u00f3n. Un servidor remoto no autenticado (accesible siempre que un cliente sigue redirecciones, obtiene URL proporcionadas por el usuario o procesa webhooks) puede elevar la memoria del cliente arbitrariamente y desencadenar una condici\u00f3n de falta de memoria.\n\nEste problema afecta a mint: desde 0.5.0 antes de 1.9.1."}], "id": "CVE-2026-56810", "lastModified": "2026-10-25T15:10:00.147", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-56810", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-06T15:52:57.089606Z", "version": "2.0.3"}}]}, "published": "2026-07-06T11:16:30.983", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://cna.erlef.org/cves/CVE-2026-56810.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/elixir-mint/mint/commit/193ce714907d16e8adc4ab3c40e4f0c2f045b2a6"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/elixir-mint/mint/security/advisories/GHSA-c59h-fq4p-r36r"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://osv.dev/vulnerability/EEF-CVE-2026-56810"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/elixir-mint/mint/security/advisories/GHSA-c59h-fq4p-r36r"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.5.0,1.9.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c575d819d39ebf7e9b77ec24584a5ffbb11c844e,193ce714907d16e8adc4ab3c40e4f0c2f045b2a6)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "mint", "vendor": "elixir-mint"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.5.0,1.9.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "mint", "source": "cna", "vendor": "elixir-mint"}, "product": "mint", "vendor": "elixir-mint"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c575d819d39ebf7e9b77ec24584a5ffbb11c844e,193ce714907d16e8adc4ab3c40e4f0c2f045b2a6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "mint", "source": "cna", "vendor": "elixir-mint"}, "product": "mint", "vendor": "elixir-mint"}], "created": "2026-07-06T12:15:15.212747+00:00", "updated": "2026-08-01T18:45:03.842634+00:00", "vendors": ["elixir-mint", "elixir-mint$PRODUCT$mint"]}