{"metadata": {"vulnerability": "cve-2026-48862", "count": 15, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-05-25T20:44:10.697Z", "date_only": false, "value": "2026-05-25T20:44:10.697Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-48862", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-06-02T14:15:10.591Z", "date_only": false, "value": "2026-06-02T14:15:10.591Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-48862", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-06-02T16:16:44Z", "date_only": false, "value": "2026-06-02T16:16:44Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-G586-CCQF-7X4R", "record": "GHSA-G586-CCQF-7X4R", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-06-02T16:16:44.627Z", "date_only": false, "value": "2026-06-02T16:16:44.627", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-48862", "record": "FKIE_CVE-2026-48862", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-06-02T17:34:10.424Z", "date_only": false, "value": "2026-06-02T17:34:10.424482Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mnd4vzmrwx2t", "record": "CVE-2026-48862", "field": "creation_timestamp", "uuid": "69556ecb-2f76-4df4-a252-59e50a44d30d", "content": "CVE-2026-48862 - Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrency\nCVE ID : CVE-2026-48862\n \n Published : June 2, 2026, 4:16 p.m. | 16\u00a0minutes ago\n \n Description : Allocation of Resources Without Limits or Throttling vulnerability in e...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3mnd4vzmrwx2t"}, {"timestamp": "2026-06-02T18:11:00.524Z", "date_only": false, "value": "2026-06-02T18:11:00.524487Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-48862", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-06-02T18:11:00.524Z", "date_only": false, "value": "2026-06-02T18:11:00.524487Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-48862", "record": "FKIE_CVE-2026-48862", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-06-02T18:11:05.599Z", "date_only": false, "value": "2026-06-02T18:11:05.599Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-48862", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-02T19:14:09.683Z", "date_only": false, "value": "2026-06-02T19:14:09.683Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-48862", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-06-02T19:14:09.683Z", "date_only": false, "value": "2026-06-02T19:14:09.683Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / EEF", "record": "cve-2026-48862", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-09T23:19:29Z", "date_only": false, "value": "2026-07-09T23:19:29Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-G586-CCQF-7X4R", "record": "GHSA-G586-CCQF-7X4R", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-09T23:19:29Z", "date_only": false, "value": "2026-07-09T23:19:29Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-G586-CCQF-7X4R", "record": "GHSA-G586-CCQF-7X4R", "field": "modified"}, {"timestamp": "2026-07-09T23:42:44.317Z", "date_only": false, "value": "2026-07-09T23:42:44.317323Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/be308f55a57246cb8ce657d04b30b2e9", "record": "CVE-2026-48862", "field": "creation_timestamp", "uuid": "9ab3bf01-2f49-4fa1-873d-d968a9e7a25d", "content": "# CVE-2026-48862: CVE-2026-48862: Unbounded Resource Allocation via HTTP/2 PUSH_PROMISE Flooding in Mint\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-07-09\n> **Full Report:** https://cvereports.com/reports/CVE-2026-48862\n\n## Summary\nAn allocation of resources without limits or throttling vulnerability in the Elixir Mint HTTP client library allows malicious HTTP/2 servers to trigger memory exhaustion and application denial of service. The flaw exists because Mint fails to validate server-push concurrency limits during the receipt of PUSH_PROMISE frames, deferring validation to the HEADERS phase. This allows a server to reserve an unlimited number of streams in the client's memory map.\n\n## TL;DR\nA flaw in Elixir's Mint HTTP client allows hostile HTTP/2 servers to exhaust client memory by flooding PUSH_PROMISE frames without sending headers. This triggers unbounded state allocation in the Erlang VM and crashes the client.\n\n## Technical Details\n\n- **CWE ID**: CWE-770 (Allocation of Resources Without Limits or Throttling)\n- **Attack Vector**: Network\n- **CVSS Score**: 8.2 (High)\n- **EPSS Score**: 0.00384 (30.40th percentile)\n- **Impact**: Denial of Service (Memory Exhaustion / Crash)\n- **Exploit Status**: none (No public weaponized exploits)\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Mint HTTP Client (Elixir)\n- **mint**: >= 0.2.0, < 1.9.0 (Fixed in: `1.9.0`)\n\n## Mitigation\n\n- Disable HTTP/2 Server Push explicitly in connection parameters when connecting to untrusted third-party endpoints.\n- Upgrade the Mint dependency in Hex to version 1.9.0 or higher.\n- Implement process-level memory limits within the Erlang VM to prevent single-process leaks from crashing the entire virtual machine.\n\n**Remediation Steps:**\n1. Open the mix.exs file in the Elixir project.\n2. Locate the :mint dependency definition and update the version string to '>= 1.9.0'.\n3. Run the command 'mix deps.get' to fetch and compile the updated library.\n4. Verify the update by confirming that 'mix.lock' references version 1.9.0 or later.\n5. Redeploy the application to production.\n\n## References\n\n- [GitHub Security Advisory: GHSA-g586-ccqf-7x4r](https://github.com/elixir-mint/mint/security/advisories/GHSA-g586-ccqf-7x4r)\n- [Official Patch Commit](https://github.com/elixir-mint/mint/commit/70b97b6a5209fb288b0e04d8e657dda26c59de67)\n- [Erlang Ecosystem Foundation Advisory](https://cna.erlef.org/cves/CVE-2026-48862.html)\n- [OSV Database Entry](https://osv.dev/vulnerability/EEF-CVE-2026-48862)\n- [NVD Details Page](https://nvd.nist.gov/vuln/detail/CVE-2026-48862)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-48862) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/be308f55a57246cb8ce657d04b30b2e9"}, {"timestamp": "2026-07-10T00:35:14.297Z", "date_only": false, "value": "2026-07-10T00:35:14.297605Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/elixir-mint/mint/security/advisories/GHSA-g586-ccqf-7x4r", "record": "CVE-2026-48862", "field": "creation_timestamp", "uuid": "5a46a758-3d37-4371-9beb-af803b293551", "url": "https://github.com/elixir-mint/mint/security/advisories/GHSA-g586-ccqf-7x4r", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-22T19:10:00.120Z", "date_only": false, "value": "2026-07-22T19:10:00.120", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-48862", "record": "FKIE_CVE-2026-48862", "field": "lastModified"}], "metrics": {"as_of": "2026-10-31T09:03:54.653Z", "anchors": {"origin": {"timestamp": "2026-06-02T14:15:10.591Z", "date_only": false, "value": "2026-06-02T14:15:10.591Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-48862", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-06-02T14:15:10.591Z", "date_only": false, "value": "2026-06-02T14:15:10.591Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-48862", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-07-10T00:35:14.297Z", "date_only": false, "value": "2026-07-10T00:35:14.297605Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/elixir-mint/mint/security/advisories/GHSA-g586-ccqf-7x4r", "record": "CVE-2026-48862", "field": "creation_timestamp", "uuid": "5a46a758-3d37-4371-9beb-af803b293551", "url": "https://github.com/elixir-mint/mint/security/advisories/GHSA-g586-ccqf-7x4r", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 3234003.706, "hours": 898.3343627777778, "days": 37.43059844907407, "min_seconds": 3234003.706, "max_seconds": 3234003.706, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-06-02T14:15:10.591Z", "date_only": false, "value": "2026-06-02T14:15:10.591Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-48862", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-07-10T00:35:14.297Z", "date_only": false, "value": "2026-07-10T00:35:14.297605Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/elixir-mint/mint/security/advisories/GHSA-g586-ccqf-7x4r", "record": "CVE-2026-48862", "field": "creation_timestamp", "uuid": "5a46a758-3d37-4371-9beb-af803b293551", "url": "https://github.com/elixir-mint/mint/security/advisories/GHSA-g586-ccqf-7x4r", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 13027724.062716, "hours": 3618.812239643333, "days": 150.7838433184722, "min_seconds": 13027724.062716, "max_seconds": 13027724.062716, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-06-02T14:15:10.591Z", "date_only": false, "value": "2026-06-02T14:15:10.591Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-48862", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-31T09:03:54.653Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 9793720.356716, "hours": 2720.4778768655556, "days": 113.35324486939814, "min_seconds": 9793720.356716, "max_seconds": 9793720.356716, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-10T00:35:14.297Z", "date_only": false, "value": "2026-07-10T00:35:14.297605Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/elixir-mint/mint/security/advisories/GHSA-g586-ccqf-7x4r", "record": "CVE-2026-48862", "field": "creation_timestamp", "uuid": "5a46a758-3d37-4371-9beb-af803b293551", "url": "https://github.com/elixir-mint/mint/security/advisories/GHSA-g586-ccqf-7x4r", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-10-31T09:03:54.653Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}