The vulnerability in elixir-mint Mint involves the HTTP/2 receive path where a HEADERS frame without the END_HEADERS flag causes the header-block fragment to be accumulated in conn.headers_being_processed. Subsequent CONTINUATION frames are appended without any size or count limits, and max_header_list_size is only enforced on outgoing requests, not inbound. An attacker-controlled HTTP/2 server can exploit this by sending an endless stream of CONTINUATION frames, each up to the peer-advertised SETTINGS_MAX_FRAME_SIZE, leading to unbounded memory growth and eventual BEAM process termination. This affects mint versions from 0.1.0 up to but not including 1.9.0.

An attacker controlling an HTTP/2 server can cause a Mint client to exhaust its memory by sending a continuous flood of CONTINUATION frames, resulting in denial of service through process death. This impacts availability of applications using vulnerable versions of Mint for HTTP/2 communication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider avoiding connections to untrusted HTTP/2 servers or implement external controls to limit resource consumption. Monitor vendor channels for updates regarding a patch or official mitigation.