A memory exhaustion vulnerability in the Elixir Mint library allows unauthenticated remote servers to crash client applications, posing a significant availability risk.

This is an allocation of resources without limits or throttling (CWE-770) issue where the HTTP/1 parser fails to cap data accumulation in the connection buffer. An unauthenticated remote server can trigger this by sending incomplete status lines or unterminated chunked extensions, forcing the client to consume system memory until the process is terminated.

Successful exploitation of this vulnerability results in a denial of service, which can cause significant operational downtime for applications relying on the Mint library for HTTP communication. Given the CVSS score of 8.2, this is classified as a high-severity risk. The ability for an attacker to remotely crash services via standard HTTP interactions poses a direct threat to business continuity and service reliability.

Immediate Action: Update the Mint library to version 1.10.0 or later to implement the necessary resource limits and prevent uncontrolled buffer growth.

Proactive Monitoring: Monitor system memory usage and process logs for unexpected spikes or frequent crashes in services that utilize the Mint library for external API integrations.

Compensating Controls: Implement strict network egress filtering and utilize timeouts on HTTP requests to limit the duration and volume of data accepted from untrusted or third party servers.

Public Exploit Available: Unknown

This vulnerability represents a high-severity threat to application availability. Organizations using the Elixir Mint library must prioritize upgrading to version 1.10.0 to incorporate the required resource constraints. Failure to patch may allow remote actors to disrupt business operations through simple, unauthenticated HTTP requests.