CVE-2026-58226 – Unauthenticated denial-of-service via unbounded HPACK integer decoding in hpax

CVE ID :CVE-2026-58226

Published : July 6, 2026, 11:16 a.m. | 31 minutes ago

Description :Inefficient Algorithmic Complexity vulnerability in elixir-mint hpax allows unauthenticated denial-of-service via unbounded HPACK integer decoding.

hpax decodes HPACK variable-length integers with no upper bound on the decoded value or the number of continuation octets. ‘Elixir.HPAX.Types’:decode_remaining_integer/3 accumulates the integer as int + (value
Severity: 8.7 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…