CVE-2026-58226: CWE-407 Inefficient Algorithmic Complexity in elixir-mint hpax
Inefficient Algorithmic Complexity vulnerability in elixir-mint hpax allows unauthenticated denial-of-service via unbounded HPACK integer decoding. hpax decodes HPACK variable-length integers with no upper bound on the decoded value or the number of continuation octets. 'Elixir.HPAX.Types':decode_remaining_integer/3 accumulates the integer as int + (value <<< m), shifting by 7 more bits for each continuation octet and stopping only on a terminating octet or truncated input, never because the integer grew too large. Because BEAM integers are arbitrary precision, a run of N continuation octets builds an O(N)-bit bignum and re-adds into an ever-larger bignum on each step, so the total decoding cost is superlinear (about O(N^2)). An unauthenticated attacker who can send an HTTP/2 header block to a server using this decoder (reached through the 'Elixir.HPAX':decode/2 entry point) can supply a small header block that forces a large, attacker-controlled amount of CPU (and transient memory), a denial-of-service amplification. This issue affects hpax from 0.1.1 before 1.0.4.
AI Analysis
Technical Summary
The elixir-mint hpax library's HPACK integer decoder (decode_remaining_integer/3) does not impose an upper bound on the decoded integer size or the number of continuation octets. Because BEAM integers are arbitrary precision, an attacker can supply a header block with many continuation octets, causing the decoder to perform superlinear (approximately O(N^2)) CPU and memory operations during decoding. This leads to a denial-of-service amplification by exhausting server resources. The vulnerability affects hpax versions =0.1.1 and >=0.1.1 <1.0.4.
Potential Impact
An unauthenticated attacker can cause a denial-of-service condition by sending a crafted HTTP/2 header block that triggers excessive CPU and memory consumption during HPACK integer decoding. This can degrade or disrupt service availability on servers using the vulnerable hpax versions.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider mitigating exposure by limiting or validating incoming HTTP/2 header blocks if possible. Monitor vendor channels for updates regarding a patch or official remediation.
CVE-2026-58226: CWE-407 Inefficient Algorithmic Complexity in elixir-mint hpax
Description
Inefficient Algorithmic Complexity vulnerability in elixir-mint hpax allows unauthenticated denial-of-service via unbounded HPACK integer decoding. hpax decodes HPACK variable-length integers with no upper bound on the decoded value or the number of continuation octets. 'Elixir.HPAX.Types':decode_remaining_integer/3 accumulates the integer as int + (value <<< m), shifting by 7 more bits for each continuation octet and stopping only on a terminating octet or truncated input, never because the integer grew too large. Because BEAM integers are arbitrary precision, a run of N continuation octets builds an O(N)-bit bignum and re-adds into an ever-larger bignum on each step, so the total decoding cost is superlinear (about O(N^2)). An unauthenticated attacker who can send an HTTP/2 header block to a server using this decoder (reached through the 'Elixir.HPAX':decode/2 entry point) can supply a small header block that forces a large, attacker-controlled amount of CPU (and transient memory), a denial-of-service amplification. This issue affects hpax from 0.1.1 before 1.0.4.
CVSS v4.0
Score 8.7high
Affected software
cpe:2.3:a:elixir-mint:hpax:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The elixir-mint hpax library's HPACK integer decoder (decode_remaining_integer/3) does not impose an upper bound on the decoded integer size or the number of continuation octets. Because BEAM integers are arbitrary precision, an attacker can supply a header block with many continuation octets, causing the decoder to perform superlinear (approximately O(N^2)) CPU and memory operations during decoding. This leads to a denial-of-service amplification by exhausting server resources. The vulnerability affects hpax versions =0.1.1 and >=0.1.1 <1.0.4.
Potential Impact
An unauthenticated attacker can cause a denial-of-service condition by sending a crafted HTTP/2 header block that triggers excessive CPU and memory consumption during HPACK integer decoding. This can degrade or disrupt service availability on servers using the vulnerable hpax versions.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider mitigating exposure by limiting or validating incoming HTTP/2 header blocks if possible. Monitor vendor channels for updates regarding a patch or official remediation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- EEF
- Date Reserved
- 2026-06-29T18:54:08.633Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a4b81c427e9c797194eedd6
Added to database: 07/06/2026, 10:21:56 UTC
Last enriched: 07/06/2026, 10:36:35 UTC
Last updated: 08/19/2026, 10:57:09 UTC
Views: 137
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.