The vulnerability in elixir-mint mint (CVE-2026-91043) stems from improper enforcement of header size limits in HTTP/2. Mint.HTTP2 applies the max_header_list_size limit only to the compressed header block size, whereas RFC 9113 section 6.5.2 mandates the limit on the decoded header list size. Because HPACK compression can expand small compressed headers into large decoded headers, a malicious server can send headers that are under the compressed size limit but expand to about 1 GB of memory allocation per response on the client side. The join_cookie_headers/1 function exacerbates this by copying all cookie values into a new binary, increasing memory usage. Multiple such responses can exhaust the memory of the connection process or the entire Erlang VM, resulting in denial of service. This affects mint versions >=1.1.0 and <1.11.0.

A malicious HTTP/2 server can cause the client using affected versions of mint to allocate excessive memory, potentially exhausting process or VM memory and causing denial of service. This impacts availability of the client application relying on mint for HTTP/2 communication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider mitigating exposure by limiting connections to untrusted HTTP/2 servers or applying any recommended temporary workarounds from the vendor.