The vulnerability is an unbounded accumulation of HTTP/1 response headers and chunked trailer fields in the library’s header parsing logic. Each parsed header is stored in a list that persists across TCP segments until a terminating blank line is received, with no cap on number of headers or total size. This satisfies the definition of a resource exhaustion weakness (CWE-770) and can lead to the client process being killed by the operating system’s out‑of‑memory handler, thereby taking down the entire application that uses the library as an HTTP client. No other confidentiality or integrity compromise exists beyond service interruption.

The issue affects the Elixir Mint HTTP client library (mint) for all releases from the initial public version 0.1.0 up to, but not including, 1.9.2. Hence any application built with or dependent on an unsupported Mint version is susceptible.

The CVSS score of 8.2 marks this as a high‑severity vulnerability. The EPSS score of less than 1% indicates that the probability of exploitation in the wild is low but not zero. Because the exploit requires only the ability to influence an HTTP request sent by the vulnerable client, an attacker can reach the client directly, via an attacker‑controlled redirect, through Server‑Side Request Forgery (SSRF), or by a man‑in‑the‑middle attack. The lack of a header cap means that the memory consumption grows without bound, eventually exhausting system RAM and causing a denial of service for the application. The vulnerability is not listed in CISA’s KEV catalog, but the high severity and available exploit path recommend immediate remediation.