Mint HTTP Client CVE-2026-82728

The Mint client must initiate an HTTP/1 (not HTTP/2) connection to a server controlled or influenced by the attacker. Specific triggering paths include: (1) the application fetches URLs supplied by untrusted external input without allowlisting or sanitization; (2) the application follows HTTP redirects without validating the final destination; (3) an on-path attacker performs DNS hijacking or TCP injection to substitute a malicious server for a legitimate one. The chunk-extension variant additionally requires the server to send a valid status line and complete header section first, making it harder to detect via header-only inspection. Exploitation is not possible when the Mint client communicates exclusively with first-party, network-isolated servers, or when all HTTP/1 connections are made to allowlisted hostnames. The vulnerability does not require any authentication or special client configuration; the default max_header_list_size of 256 KiB applies only to headers, so no non-default setting makes the client safe without patching.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VA:H) places overall severity at 8.2, reflecting high availability impact with no confidentiality or integrity consequences. The AT:P modifier correctly captures the key prerequisite: the Mint client must actually send an HTTP/1 request to an attacker-controlled or attacker-redirected server, which is a specific environmental condition rather than a passive exposure. Applications that follow unvalidated redirects, fetch user-supplied URLs, or call third-party webhooks without allowlisting are meaningfully exposed; even a mid-sized municipal IT team in malbork running an Elixir-based API aggregator or notification service should treat this as urgent if they cannot immediately patch. EPSS data is not available in the provided intelligence, but the lack of any KEV listing and the absence of public exploit code suggest this has not yet been observed in active exploitation campaigns. The real-world severity is modulated by how directly attacker-controlled the server endpoint is: internal services communicating only with first-party infrastructure face substantially reduced risk. Finch, the higher-level Elixir HTTP client that wraps Mint, is also transitively affected for HTTP/1 connections. The fix is clean and low-risk - extending the existing max_header_list_size budget to cover the two previously unguarded states - making patch application the strongly preferred action over workarounds.

An attacker operates a server that responds to HTTP/1 GET requests by sending a syntactically valid status line beginning (HTTP/1.1 200 ) followed by an unending stream of bytes and no CRLF terminator. A vulnerable Mint client - perhaps an Elixir background job fetching a URL derived from user input or following an attacker-injected redirect - connects and continuously appends each incoming TCP segment to its internal conn.buffer. Within minutes, depending on available RAM and the server's bandwidth, the BEAM node's memory is exhausted and the OS kills the process, dropping all in-flight requests and potentially corrupting application state. No proof-of-concept code has been published, but implementing such a server requires trivial socket programming.