Hex/mint

CRLF injection in HTTP/1 request line via unvalidated method in Mint

Modified: 7/30/2026

Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrency

Modified: 9/8/2026

HTTP response smuggling in Mint HTTP/1 client via lenient Content-Length parsing

Modified: 7/30/2026

HTTP/2 CONTINUATION flood in Mint client via unbounded header-block accumulation

Modified: 9/8/2026

mint buffers an entire chunked response chunk in memory in Mint.HTTP1.decode_body/5

Modified: 7/30/2026

Unbounded HTTP/1 response-header and chunked-trailer accumulation in Mint causes memory-exhaustion DoS

Modified: 7/30/2026

Zero-length HTTP/2 CONTINUATION frames bypass Mint's header-block byte-size cap and exhaust client memory

Modified: 7/30/2026

Sign-tolerant HTTP/1 chunk-size parser in Mint enables response smuggling against strict intermediaries on pooled connections

Modified: 9/8/2026

Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connections

Modified: 9/19/2026

Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS

Modified: 9/8/2026

Quadratic chunk-size parsing in Mint.HTTP1.Parse allows CPU-exhaustion DoS

Modified: 9/8/2026

HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memory

Modified: 9/29/2026

Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size

Modified: 9/29/2026

Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediaries

Modified: 9/29/2026

mint: Unbounded CONTINUATION/HEADERS frame accumulation (CONTINUATION flood)

Modified: 7/9/2026

mint has potential CRLF injection in its HTTP request line via unvalidated `method`/`target`

Modified: 7/9/2026

mint: Unbounded streams map growth via PUSH_PROMISE without follow-up HEADERS

Modified: 7/9/2026

mint: Content-Length header accepts non-RFC "+" sign prefix

Modified: 7/9/2026