CVE-2026-82729: CWE-407 Inefficient Algorithmic Complexity in elixir-mint mint

The vulnerability arises in the parse_hex_prefix/2 function in lib/mint/http1/parse.ex, which processes the chunk-size field of chunked HTTP responses. The function accumulates each hex digit into an arbitrary-precision number without limiting the digit count, resulting in O(N squared) CPU complexity for N digits. The handle_data/2 function prepends incoming data and re-parses from the start on each socket message, allowing a remote server to incrementally send a large number of hex digits and cause repeated expensive parsing. This can exhaust CPU resources on the client side, causing a denial of service. The vulnerability is present in mint versions 1.9.3 through before 1.10.0.

A remote HTTP server can exploit this vulnerability by sending a chunked response with an extremely large chunk-size field, causing the client to consume excessive CPU resources. This results in a denial of service condition on the client host. The vulnerability does not require authentication or user interaction and can be triggered by a network attacker controlling the HTTP server. There is no indication of data compromise or code execution, only resource exhaustion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is documented in the provided data. Until a patch is available, users should consider limiting exposure to untrusted HTTP servers or implementing network-level protections to detect and block suspiciously large chunked responses. Monitor vendor channels for updates regarding an official fix.