Elixir Mint CVE-2026-92103

Requires an Elixir application to use mint (0.1.0-1.10.x) as an HTTP/2 client and to establish a connection to an attacker-controlled or MITM-intercepted HTTP/2 server; no authentication or user interaction with the app itself is needed, but the attacker must control the server side of the connection (reflected as AT:P). Exploitation is strongly LIMITED: impact is memory-only with no amplification (the server must send every buffered byte), each connection is capped at ~16 MiB by the 24-bit frame-length field, and the malicious frames must be crafted to withhold the final byte to keep decode_next/2 returning :more; sustained denial of service therefore requires many concurrently held connections and matching attacker resources.

This is a genuine but low-severity availability issue, not a high-priority emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L, 6.3 Medium) correctly captures a network-reachable, unauthenticated, availability-only impact, with AT:P reflecting the key requirement that the victim client must connect to (or be MITM'd onto) an attacker-controlled HTTP/2 server. The impact is explicitly bounded: the description confirms there is NO amplification - the malicious server must transmit every byte the client buffers, and the buffer is capped by the 24-bit frame-length field at roughly 16 MiB per connection. Exploitation status: no public exploit identified at time of analysis (no POC referenced, no KEV listing, no EPSS provided). Because impact is memory pressure only (no confidentiality/integrity, no crash guaranteed) and is per-connection with no amplification, real-world risk is modest - meaningful DoS requires the attacker to open and hold many connections, spending equal server-side memory/bandwidth. Priority is LOW: patch is available (fixed in 1.11.0), but this is a hardening fix rather than an actively-exploited flaw. No signals conflict; the description and CVSS vector are mutually consistent.

An Elixir application uses mint as its HTTP/2 client to reach an external endpoint that an attacker controls or can intercept (e.g., a webhook target, upstream API, or MITM position). The malicious server sends HTTP/2 frames each declaring a length near the 16,777,215-byte maximum but withholds the final byte, so decode_next/2 returns :more and Mint.HTTP2 retains all received bytes in the connection buffer (~16 MiB per connection). By holding many such connections open, the attacker drives the client's memory consumption up. No public exploit code was identified at time of analysis.