The vulnerability in elixir-mint mint arises from the Mint.HTTP1.decode_headers/5 and Mint.HTTP1.decode_trailer_headers/4 functions, which accumulate parsed response headers and chunked-trailer fields into a per-request list (request.headers_buffer) that persists across TCP segments. There is no limit on the number or total size of these headers, and the underlying Erlang parser is invoked without size limits. Consequently, a malicious HTTP server can stream headers or trailers indefinitely without a terminating blank line, causing unbounded memory consumption on the client side. This can exhaust system memory and crash the BEAM node, causing denial of service to the application using Mint.

A remote attacker controlling an HTTP server or able to intercept traffic can cause the Mint client to consume unlimited memory by streaming headers or trailers without termination. This leads to exhaustion of memory resources on the client host, crashing the BEAM node and causing denial of service to the entire application relying on Mint for HTTP communication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using untrusted HTTP servers or intermediaries that could exploit this vulnerability. Monitor for updates from the elixir-mint project regarding patches or official fixes.