CVE-2026-82728: CWE-770 Allocation of Resources Without Limits or Throttling in elixir-mint mint

The vulnerability in elixir-mint mint involves allocation of resources without limits or throttling (CWE-770) in the HTTP/1 response parser. Specifically, the decode_status_line/4 function stores unconsumed data in conn.buffer when the status line is incomplete, and decode_body/5 does the same for unterminated chunk-extension lines. Both states wait for a CRLF that the server is not required to send, causing conn.buffer to grow indefinitely as it prepends to every subsequent socket message. The :max_header_list_size limit is only applied in decode_headers/5 and decode_trailer_headers/4, so these states are not protected. A malicious or attacker-controlled server can exploit this by streaming bytes indefinitely, causing the BEAM node to be killed by the OS out-of-memory handler. The chunk-extension variant occurs after a valid status line and header section, making it difficult for intermediaries inspecting only headers to detect the attack. This affects all mint versions from 0.1.0 before 1.10.0.

A remote HTTP server can cause the client using elixir-mint mint to exhaust its memory resources by streaming data indefinitely without limits, leading to a denial of service via out-of-memory termination of the BEAM node. This can disrupt applications relying on mint for HTTP communication, potentially causing service outages or crashes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is indicated in the provided data. Until a patch is available, users should be cautious when connecting to untrusted or attacker-controlled HTTP servers and consider additional network-level protections to limit exposure.