The vulnerability is a resource‑exhaustion flaw originating from the HTTP/2 CONTINUATION frame handling path in Mint. Attackers can send an unbounded sequence of CONTINUATION frames, which are appended to an in‑memory accumulator without any per‑stream size limit or frame‑count limit. The result is uncontrolled growth of the iolist that drives memory usage arbitrarily high, eventually exhausting the BEAM process and causing it to terminate. This flaw is classified as CWE‑770 and demonstrates that the client has no throttling or limiting mechanisms for inbound header blocks.

Elixir‑mint Mint clients ranging from the initial 0.1.0 release up to, but not including, version 1.9.0 are affected. Any installation that relies on a Mint version older than 1.9.0 and communicates with HTTP/2 servers that may be compromised or malicious is vulnerable. The official CPE string identifies the product as elixir‑mint:mint, and the vulnerability applies to all prior releases.

The CVSS score of 8.2 indicates a high severity classification. The EPSS value is not provided, but the flaw is listed as not being part of the CISA KEV catalog. A single outbound connection to an attacker‑controlled HTTP/2 endpoint constitutes sufficient preconditions for exploitation; no authentication or special privileges are required. Because the vulnerable code path lacks any safeguard against excessive memory allocation, the exploitation pathway is straightforward for an attacker who can establish a connection to the client, making the risk relatively high if the client receives requests from untrusted servers.