Vulnerability · Published Jul 6, 2026 · Assigned by EEF
CVE-2026-58226Unauthenticated denial-of-service via unbounded HPACK integer decoding in hpax
High 8.7
In plain English
A high-severity security flaw in hpax from elixir-mint. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).
Official description
Inefficient Algorithmic Complexity vulnerability in elixir-mint hpax allows unauthenticated denial-of-service via unbounded HPACK integer decoding. hpax decodes HPACK variable-length integers with no upper bound on the decoded value or the number of continuation octets. 'Elixir.HPAX.Types':decode_remaining_integer/3 accumulates the integer as int + (value <<< m), shifting by 7 more bits for each continuation octet and stopping only on a terminating octet or truncated input, never because the integer grew too large. Because BEAM integers are arbitrary precision, a run of N continuation octets builds an O(N)-bit bignum and re-adds into an ever-larger bignum on each step, so the total decoding cost is superlinear (about O(N^2)). An unauthenticated attacker who can send an HTTP/2 header block to a server using this decoder (reached through the 'Elixir.HPAX':decode/2 entry point) can supply a small header block that forces a large, attacker-controlled amount of CPU (and transient memory), a denial-of-service amplification. This issue affects hpax from 0.1.1 before 1.0.4.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| elixir-mint | hpax | 0.1.1 – before 1.0.4 |
| elixir-mint | hpax | 56db437a7e2c515e3bdd770ac7947b02cd2390d0 – before 1ba4bb2dc91e80089cf89c73970ac3ded76f17eb |
Weakness: CWE-407 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N