The vulnerability is a resource‑exhaustion flaw in the Mint HTTP/2 client library. The client accumulates header‑block fragments when processing a series of CONTINUATION frames. Because an attacker can send an endless chain of zero‑length CONTINUATION frames without triggering the size limit. Each frame increases a nested data structure, so client memory grows unbounded, eventually exhausting.

The flaw affects the Elixir Mint HTTP client, specifically the mint project ( from 0.1.0 up to but not including 1.9.2 are vulnerable. Clients that use the library in HTTP/2 contexts are at risk. No specific OS or platform is singled out, as the issue lies in the library code.

The CVSS base score of 6.3 indicates a moderate severity, and the EPSS score under 1% implies that exploitation is currently considered unlikely. The flaw is not listed in CISA's KEV catalog. The attacker requires the ability to act as an HTTP/2 server reachable from the client – which can be achieved directly, via redirect, SSRF, or MITM. Once connected, the attacker can send a HEADERS frame followed by an unlimited stream of zero‑length CONTINUATION frames, forcing the client to allocate memory until the BEAM node terminates. Because the issue is triggered by data from an external party, the attack vector is remote and does not depend on local code execution.