The vulnerability stems from the Mint HTTP client’s unbounded buffering of chunked transfer‑encoded responses. When a server declares an excessively large chunk size, the client stores each byte in an unbounded iolist until the full chunk is received, which may never happen if the data is sent slowly. This unchecked allocation can cause the client process to consume an arbitrarily large amount of memory, leading to an out‑of‑memory condition and a denial of service. The weakness is an open‑ended resource allocation flaw (CWE‑770).

The affected package is the Elixir library Mint, versions from 0.5.0 through 1.9.0. Applications that use Mint.HTTP1 to parse HTTP/1.1 responses, such as those that download content, follow redirects, or process webhooks, are potentially impacted if the library is in their dependency tree.

The CVSS score of 8.7 indicates high severity, and the EPSS score of <1% shows a low but non‑zero probability of exploitation. The flaw can be triggered by any unauthenticated remote server that sends a deliberately large chunk size and streams data slowly, causing the client to allocate memory indefinitely. While it is not listed in the CISA KEV catalog, the combination of high impact and the possibility of distribution through public servers makes it prudent to monitor for attempts to exploit the flaw.