The elixir-mint hpax library's HPACK integer decoder (decode_remaining_integer/3) does not impose an upper bound on the decoded integer size or the number of continuation octets. Because BEAM integers are arbitrary precision, an attacker can supply a header block with many continuation octets, causing the decoder to perform superlinear (approximately O(N^2)) CPU and memory operations during decoding. This leads to a denial-of-service amplification by exhausting server resources. The vulnerability affects hpax versions =0.1.1 and >=0.1.1 <1.0.4.

An unauthenticated attacker can cause a denial-of-service condition by sending a crafted HTTP/2 header block that triggers excessive CPU and memory consumption during HPACK integer decoding. This can degrade or disrupt service availability on servers using the vulnerable hpax versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider mitigating exposure by limiting or validating incoming HTTP/2 header blocks if possible. Monitor vendor channels for updates regarding a patch or official remediation.