The Mint HTTP/2 client delayingly validates frame sizes until an entire payload is received. During this period it keeps each byte in a connection buffer. A malicious server can declare a frame length up to 16,777,215 bytes and send it incrementally, causing the client to accumulate roughly 16 MiB per connection in memory before rejecting the frame. This uncontrolled allocation can exhaust client RAM, leading to a denial‑of‑service condition. The weakness is a classic example of CWE‑770: allocation of resources without limits or throttling.

All publicly available releases of the elixir‑mint Mint HTTP/2 client from version 0.1.0 up to but not including 1.10.2 are affected. The vulnerability does not exist in releases 1.10.2 and newer, which fixed the frame‑size check to be performed before buffering data. Applications that integrate Mint directly, as well as higher‑level HTTP clients such as Finch and Req that rely on Mint, are at risk when receiving untrusted HTTP/2 traffic.

The CVSS score of 6.3 reflects a moderate severity. The EPSS score indicates a very low probability of exploitation (<1 %), and the vulnerability is not listed in CISA’s KEV catalog, so it has not been observed in the wild yet. Nevertheless, an attacker who can open an HTTP/2 connection to a vulnerable client can cause the client to consume significant RAM until the connection is closed. Based on the description, it is inferred that the most likely attack vector is a malicious HTTP/2 server that sends an oversized frame and holds the connection open, which can be mitigated by restricting the client to HTTP/1 or upgrading to the corrected version.