The vulnerability arises when the Mint HTTP client processes chunked responses and buffers each byte of a chunk without a size limit. The chunk size is read from the server and accepted as an unbounded integer, so an attacker can declare a huge size (for example 2 GiB) and then stream data slowly, never completing the chunk. During that time the client continuously stores received data in an unbounded iolist, causing the process to consume unlimited memory until an out‑of‑memory failure occurs. The weakness is an unbounded resource allocation flaw (CWE‑770). The impact is a denial of service that can be experienced by any client that retrieves data via Mint’s HTTP1 module, including when following redirects, downloading user‑supplied URLs, or processing webhooks.

The affected product is the Elixir library Mint, versions from 0.5.0 up through 1.9.0. Applications that import Mint to perform HTTP/1.1 requests, such as web clients, services that consume external APIs, or any process that processes external URLs, are potentially impacted if they use an affected Mint version in their dependency tree.

The CVSS score of 8.7 indicates high severity, and the EPSS score of < 1 % shows a low but non‑zero likelihood of exploitation. An unauthenticated remote server can trigger the flaw by sending an oversized chunk size and streaming the data slowly. Because no special permissions are required and the client is widely used in Elixir applications, the attack could originate from any entity that can force the client to fetch a URL. The flaw is not listed in the CISA KEV catalog, but the combination of high impact and the potential to affect many public services warrants proactive monitoring for suspicious traffic or memory exhaustion events.