AIKIDO-2026-275964

TL;DR

Mint's HTTP/1 chunked body decoder in Mint.HTTP1.Parse.chunk_size/1 validates only the leading hex digits of a chunk size line and hands the remaining bytes to Parse.ignore_until_crlf/1, which advances over any byte until it reaches CRLF. A server can send chunk size lines with trailing bytes that Mint accepts but an RFC 9112 strict intermediary rejects, creating a chunk framing mismatch that a shared keep-alive connection can use for response smuggling against later requests. The fix adds Mint.HTTP1.Parse.chunk_extensions/1, which only accepts whitespace and well formed semicolon delimited chunk extensions before the CRLF and rejects anything else.