Elixir Mint CVE-2026-58229

Exploitation requires the Mint HTTP/1 client to establish a connection to attacker-influenced content and requires no authentication or user interaction (PR:N/UI:N). The concrete precondition is that the attacker controls (or MITMs) the HTTP server the client talks to - reachable directly, through an attacker-controlled HTTP redirect, or via an SSRF sink where the client fetches an attacker-supplied URL. The trigger is a server that emits complete header lines, or complete chunked-trailer lines after a chunked body, indefinitely without the terminating blank line. Limiting factors: this is an HTTP/1-only code path (HTTP/2 not implicated); it affects only Mint versions before 1.9.2; and the AT:P metric reflects that the victim must be driven to connect to the malicious endpoint rather than the attacker reaching the client unsolicited. Impact is limited to availability (denial of service) - no data disclosure or modification.

The vendor CVSS 4.0 score is 8.2 (High) with vector AV:N/AC:L/AT:P/PR:N/UI:N and VA:H - a pure availability impact (no confidentiality or integrity effect), consistent with a denial-of-service memory-exhaustion bug. The AT:P (Attack Requirements: Present) metric correctly captures that exploitation is not purely opportunistic: the victim client must be induced to connect to attacker-controlled content, whether directly, via an attacker-controlled redirect, via SSRF, or via a man-in-the-middle position. That precondition is the main mitigating factor; against services that fetch arbitrary/user-supplied URLs it is trivially met, which raises real-world risk. No EPSS value, KEV status, or POC flag was supplied in the input, so exploitation probability cannot be quantified - treat 'no public exploit identified' as absence of data, not proof of low interest. Net: a genuine and easy-to-trigger DoS for any Elixir service using Mint to reach untrusted or redirect-following endpoints, but confined to availability.

An Elixir service using Mint to fetch a user-supplied or third-party URL (e.g. a webhook validator, link previewer, or SSRF-reachable internal fetch) is pointed at an attacker-controlled server. That server responds by streaming valid HTTP header lines (or chunked-trailer lines after a body) endlessly and never sends the terminating blank line, causing request.headers_buffer to grow until the OS OOM-killer terminates the BEAM node and the whole application. No public POC is referenced, but the attack requires only a standard malicious HTTP server and low attack complexity (AC:L).