AIKIDO-2026-325701
mint is vulnerable to Allocation of Resources Without Limits or Throttling
82
High Risk
This Affects:
mintTL;DR
Mint's HTTP/1 response parser accumulates the status line and chunk-extension bytes in a per connection buffer with no size limit. A malicious server that a client connects to can withhold the terminating CRLF and stream data, growing the buffer until the calling process exhausts memory and crashes. These parser states are outside the existing header size budget, so the maximum header list size option does not constrain them. The fix bounds the status line and chunk-extension line lengths and rejects responses that exceed them.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use Mint as an HTTP/1 client to fetch responses from servers you do not control.
Background info
mint is vulnerable to Allocation of Resources Without Limits or Throttling in versions 0.1.0 - 1.9.3.
How to fix this
Upgrade the mint library to the patch version.
Links
Other
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.