The Mint HTTP/2 client allocates a reserved stream entry for every inbound PUSH_PROMISE frame without checking the configured max_concurrent_streams limit. The concurrency cap is only validated when the promised stream’s HEADERS arrive, so a server can send many PUSH_PROMISE frames and withhold the matching HEADERS until the client is overwhelmed. An attacker controlling an HTTP/2 server can therefore force the client to grow its internal conn.streams table without bound, exhausting heap memory and ultimately crashing or becoming unresponsive.

The vulnerability affects elixir‑mint:mint releases from 0.2.0 up through, but not including, 1.9.0. Default configuration enables HTTP/2 server push; clients that allow push from unfamiliar servers are vulnerable. The issue is tied to the client library itself and not to application code that uses it.

The CVSS base score of 8.2 indicates high severity, and the EPSS score is not currently available. The exploit requires only a persistent HTTP/2 connection to a malicious server with server push enabled, a scenario that an attacker can easily orchestrate. Though not listed in the CISA KEV catalog, the lack of an upper bound on stream entries means a single long‑lived connection can deplete system memory, posing a significant risk to services that depend on continuous uptime.