The updated CVE description confirms a memory exhaustion vulnerability in the Elixir Mint HTTP client that can lead to denial of service. A malicious HTTP/2 server can send header blocks that are compressed using HPACK. The compressed size is limited by the client’s max_header_list_size, but the decoded header list may grow to a much larger size. Each HPACK indexed field uses one byte on the wire format and expands into a dynamic table entry that can be up to 4 KB. When the server sends many cookie values, the client copies each value into its own binary, causing the memory consumption to balloon. In the default configuration where the wire limit is 256 KB, a single response can force the client to allocate roughly 1 GB of memory, and multiple such responses can exhaust the entire process or whole virtual machine. This results in memory exhaustion and a denial of service for the client application.

The vulnerability affects the Elixir Mint HTTP client library. Versions from 1.1.0 up to but not including 1.10.2 are impacted. Users deploying older versions of the mint package should review the version in use and consider upgrading when the fix is available.

The CVSS score of 8.2 classifies the issue as high severity. Because the attack requires control over the HTTP/2 server, a remote adversary capable of acting as a server can trigger the vulnerability by sending specially crafted header blocks. The EPSS score of 0.00384 indicates a very low but non‑zero likelihood of exploitation, and the flaw is currently not listed in the CISA KEV catalog. Nonetheless, the potential to exhaust memory makes the exploitation attractive to disrupt services, especially for long‑running client processes that maintain persistent connections to untrusted servers. The lack of a client‑side throttle means an attacker can repeatedly issue large responses to deplete resources during a single session or across multiple sessions.