The vulnerability CVE-2026-49754 in elixir-mint Mint HTTP client library allows a malicious or compromised HTTP/2 server to exhaust memory on the client by sending an endless sequence of CONTINUATION frames after a HEADERS frame lacking the END_HEADERS flag. The client accumulates these header fragments in conn.headers_being_processed without any per-stream size or frame-count limits, and the max_header_list_size setting is not enforced on inbound headers. This unchecked accumulation can cause the client's memory usage to grow arbitrarily large, leading to BEAM process death. The issue affects versions from 0.1.0 up to but not including 1.9.0. There is no vendor advisory or patch currently available, and the vulnerability is rated high severity with a CVSS 4.0 score of 8.2.

An attacker controlling an HTTP/2 server can cause a Mint client to exhaust its memory resources by sending a continuous stream of CONTINUATION frames, leading to denial of service via process termination. This can disrupt applications relying on the Mint client for HTTP/2 communication. No privilege or user interaction is required for exploitation. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting exposure to untrusted HTTP/2 servers or implementing external controls to detect and block abnormal HTTP/2 CONTINUATION frame sequences. Avoid connecting to untrusted HTTP/2 endpoints where possible.