elixir-mint EUVD-2026-41862

Exploitation requires the victim application to initiate an outbound HTTP/1.1 request to a server the attacker controls or can influence, and that server must return a chunked (Transfer-Encoding: chunked) response with an inflated chunk-size line while sending body bytes slowly and never completing the chunk. Concrete trigger surfaces named in the advisory: the client following redirects to an attacker host, fetching user-supplied URLs, or processing webhooks. No authentication or user interaction is needed on the wire (PR:N/UI:N), and default configurations are vulnerable. The practical LIMITING factor is directional: the attacker acts as the SERVER, so exploitation is gated by whether the application ever makes requests to untrusted destinations - apps that only contact a fixed set of trusted internal endpoints are effectively out of reach, and only the HTTP/1 chunked path (not Content-Length streaming, not necessarily HTTP/2) is affected.

The CVSS 4.0 base of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N, VA:H, all other impacts N) accurately frames this as a high-severity, availability-only issue: network-reachable, low complexity, no authentication, no user interaction, but no confidentiality or integrity consequence. The key nuance is that the 'attacker' is the SERVER, not a client-side intruder - exploitation requires the victim application to make an outbound request to a host the attacker controls or can influence, which happens routinely when clients follow redirects, fetch user-supplied URLs, or process webhooks. No EPSS score, POC, or KEV entry was provided, so real-world exploitation is unconfirmed; the risk is credible but conditional on how the application sources request destinations. This is a genuine priority for services that fetch untrusted URLs (SSRF-adjacent surfaces, link previews, webhook fetchers) and a lower priority for apps that only call a fixed set of trusted internal endpoints.

An application uses Mint (directly or via Finch/Req) to fetch a user-submitted URL for link-preview generation. The attacker hosts a server that responds with Transfer-Encoding: chunked and a chunk-size line of 7FFFFFFF, then trickles body bytes without ever completing the chunk; Mint buffers every byte in data_buffer until the BEAM VM exhausts memory and the node is OOM-killed. No exploit code is publicly identified, but the attack is straightforward given the network vector and low complexity.