The vulnerability arises because Mint's HTTP/2 implementation inserts a :reserved_remote entry into the connection's streams map for every PUSH_PROMISE frame received without consulting the max_concurrent_streams limit at that time. The concurrency limit is only checked later when the response HEADERS frame for the promised stream arrives. A malicious HTTP/2 server can send many PUSH_PROMISE frames and withhold the corresponding HEADERS frames, causing the client to allocate resources indefinitely and eventually exhaust memory. This affects Mint versions from 0.2.0 before 1.9.0.

An attacker controlling an HTTP/2 server can cause a Mint client to consume excessive memory by sending a flood of PUSH_PROMISE frames without corresponding HEADERS frames. This can lead to denial of service through memory exhaustion in the client process. The vulnerability does not require user interaction or privileges and can be triggered over a network connection.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling HTTP/2 server push in the client configuration if possible (e.g., setting client_settings.enable_push to false) to prevent PUSH_PROMISE frames from being accepted. Monitor for updates from the elixir-mint project regarding an official fix.