Elixir Mint EUVD-2026-43643

The Mint client must initiate an HTTP/2 connection to an attacker-controlled server; this can occur via four paths documented in the advisory: (1) direct connection - the application explicitly connects to a malicious host; (2) redirect - a legitimate server issues a 3xx redirect to an attacker-controlled HTTP/2 endpoint and the client follows it; (3) SSRF - the application fetches a user-supplied or externally influenced URL via Mint and the attacker points it at a malicious server; (4) MitM - a network-position attacker intercepts the HTTP/2 stream and injects the malicious frame sequence. The victim application must be running mint 0.1.0-1.9.1 and must be speaking HTTP/2 (not HTTP/1.1) with the target server. No authentication on the victim side is required; the attack is mounted entirely by the server sending crafted frames. Exploitation is limited to scenarios where the client makes outbound HTTP/2 connections to endpoints that are not fully trusted - applications whose only outbound HTTP/2 targets are hardcoded, trusted hosts are not at risk from external actors.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VA:L) scores 6.3. The AT:P (attack requirement present) is the primary mitigating factor: exploitation requires the Mint client to connect to an attacker-controlled HTTP/2 server, whether directly, via redirect, SSRF, or MitM. The VA:L (Low vulnerable-system availability) rating appears to understate impact: the described outcome is BEAM node OOM termination - a complete, unrecoverable application crash - which would typically warrant VA:H. This discrepancy between the score and the described impact should be verified with the reporter (EEF/ERLEF). Applications making outbound HTTP/2 requests to untrusted or user-influenced endpoints, including Finch-based Phoenix applications with SSRF exposure, carry meaningfully higher real-world risk than the base score implies. No EPSS data was supplied; in the absence of KEV listing or public POC, opportunistic mass exploitation is unlikely at present, but the attack is trivially constructed by anyone with HTTP/2 server control.

An attacker operates an HTTP/2 server and causes a Mint-based Elixir client to connect to it - for example, by exploiting an SSRF vulnerability in a Phoenix application to point an outbound request at the attacker's host, or by inserting a redirect from a legitimate server to the malicious endpoint. The server opens a stream with a HEADERS frame omitting END_HEADERS, then continuously emits zero-length CONTINUATION frames; the client BEAM VM allocates one cons cell per frame and eventually exhausts available heap memory, terminating the application process. No public proof-of-concept has been identified, but the attack requires only standard HTTP/2 server implementation capabilities.