CVE-2026-82728

Mint, the Elixir HTTP client library, contains an allocation-without-limits flaw in its HTTP/1 response parser that lets a remote HTTP server exhaust memory on the client host and cause a denial of service. When the parser is holding an incomplete status line (decode_status_line/4) or an unterminated chunk-extension line (decode_body/5), it accumulates all unconsumed server data in conn.buffer with no size cap — the :max_header_list_size budget is wired only into header and trailer parsing — and that buffer is re-prepended to every subsequent socket message while the parser waits for a CRLF the server never has to send. Any malicious server, or an ordinary server reached via an attacker-controlled redirect or a fetched URL, can therefore stream bytes indefinitely until the operating system's OOM handler kills the BEAM node; the chunk-extension path is reached only after a valid status line and a complete, valid header section, so intermediaries inspecting only headers see an ordinary 200 response. Any application using mint 0.1.0 through any version before 1.10.0 to issue outbound HTTP/1 requests — especially those fetching user-supplied URLs or following redirects — is affected. No public proof-of-concept, in-the-wild exploitation, or CISA KEV listing is currently known; EPSS estimates a 0.5% chance of exploitation within 30 days.

What to do: Upgrade mint to 1.10.0 or later. Until patched, restrict mint-based outbound HTTP/1 requests to trusted servers, limit or validate redirects to untrusted hosts, and consider BEAM-level memory limits or aggressive connection timeouts to blunt memory-exhaustion attacks. Audit code paths that fetch user-supplied URLs, since those are the easiest trigger for an attacker.