The vulnerability arises in Mint.HTTP2.Frame.decode_next/2 where the client buffers incoming HTTP/2 frames without enforcing the max_frame_size limit until the full payload is received. Since a frame length can be declared up to 16,777,215 bytes, a malicious server can withhold the last byte, causing the client to buffer roughly 1,024 times the default max_frame_size (16,384 bytes) per connection. This leads to excessive memory consumption on the client side. The server must send all buffered bytes eventually, so there is no amplification beyond the frame length limit. The vulnerability affects mint versions >=0.1.0 and <1.11.0.

An attacker controlling a malicious HTTP/2 server can cause the mint client to consume excessive memory (up to about 16 MiB per connection) by exploiting the delayed frame size validation. This can lead to resource exhaustion on the client side, potentially degrading performance or causing denial of service conditions. There is no amplification beyond the declared frame size, and no known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting connections to untrusted HTTP/2 servers or monitoring client memory usage. No official patch or workaround is documented in the provided data.