Mint CVE-2026-49754

The Mint client must initiate an HTTP/2 connection to an attacker-controlled or attacker-influenced server - this is the explicit AT:P (Attack Requirement Present) factor and the principal limit on exploitation: the attacker cannot push frames at a Mint client that never dials out to them. No authentication, user interaction, or non-default configuration is required on the victim side because max_header_list_size defaults to :infinity on all vulnerable versions, so any application using Mint <1.9.0 with default settings is exposed. Exploitation is limited to clients that actually negotiate HTTP/2 (ALPN h2) with the malicious endpoint; Mint usages pinned to HTTP/1.1, or applications that only contact a fixed allowlist of trusted servers, are not realistically reachable. Impact is availability-only (VC:N/VI:N/VA:H) - the attacker crashes the BEAM process but does not gain code execution or data access.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VA:H, base 8.2) correctly captures a network-reachable, unauthenticated availability-only impact with an Attack Requirement of Present because the victim Mint client must initiate a connection to the attacker-controlled HTTP/2 server, which is the principal limiter on real-world exploitability. No EPSS score, KEV listing, or public POC was provided, so this is best classified as a credible DoS bug with confirmed upstream fix rather than an actively exploited threat - consistent with the SSVC-style read of automatable=no (requires the victim to initiate to attacker), technical impact=partial (availability of the BEAM process). Practical risk is highest for services that perform outbound HTTP/2 fetches against untrusted or user-supplied URLs (webhooks, SSRF-adjacent fetchers, link unfurling, federated agents), and lowest for clients calling only fixed trusted endpoints; teams should prioritize the upgrade where outbound HTTP/2 destinations are not under their control.

An attacker stands up an HTTP/2 endpoint and lures a Mint-based Elixir service into fetching it - for example, a webhook target, an OAuth discovery URL, an RSS/feed fetcher, a user-supplied image proxy, or an SSRF-reachable internal service. Once the client connects, the server responds with a HEADERS frame lacking END_HEADERS and streams an endless sequence of CONTINUATION frames (each up to SETTINGS_MAX_FRAME_SIZE), driving conn.headers_being_processed to grow without bound until the BEAM process exhausts memory and the worker (and potentially the node) dies. No public exploit identified at time of analysis, but the commit's test fixture demonstrates the precise frame sequence required.