Unbounded buffering of HTTP/1 status lines and chunk-extensions in the Mint client causes the application to allocate memory without limits, resulting in a denial of service when a malicious HTTP server sends large or incomplete lines that the client never terminates. This lack of throttling demonstrates Resource Exhaustion (CWE-770) and can quickly consume all memory on the BEAM node, leading the operating system to terminate the process. The vulnerability is exploitable when a client connects to an attacker‑controlled or redirected endpoint capable of streaming arbitrary data.

The Mint library for Elixir, versions from 0.1.0 up to, but not including, 1.10.0, is affected. Any application that relies on Mint for HTTP/1 communication is susceptible because the flaw exists in both status-line parsing and chunk-extension handling and is not mitigated by the :max_header_list_size setting.

The CVSS base score of 8.2 classifies the flaw as High severity; the EPSS score is not available, yet the attack vector is remote, requiring only a crafted HTTP response from an untrusted server. Although not listed in the CISA KEV catalog, the design permits passive exploitation over any HTTP/S connection, making it a realistic risk for affected deployments. Immediate patching or mitigation is strongly advised.