The vulnerability arises because Mint.HTTP1 accumulates partial fragments of chunked HTTP response bodies in an unbounded buffer until the entire declared chunk is received. The chunk size is parsed directly from the server response without an upper bound. An attacker-controlled server can announce a very large chunk size (e.g., ~2 GiB) and send data slowly without completing the chunk, causing the client to buffer all received bytes indefinitely. This behavior can lead to excessive memory consumption and out-of-memory conditions, resulting in denial of service. The affected code is in lib/mint/http1.ex, specifically the decode_body/5 and add_body_to_buffer/2 routines. The vulnerability affects mint versions =0.5.0 and >=0.5.0 <1.9.1.

An unauthenticated remote server can exploit this vulnerability by sending a malicious chunked HTTP response with an oversized chunk size and slow data transmission. This causes the client to buffer data indefinitely, potentially exhausting system memory and causing a denial of service. The impact is high due to the ability to crash or severely degrade client applications that use the affected mint versions when processing untrusted HTTP responses.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted HTTP responses with mint versions =0.5.0 and >=0.5.0 <1.9.1, or implement external safeguards such as limiting memory usage or restricting redirects and user-supplied URLs. Monitor vendor channels for updates and apply official patches once released.