AIKIDO-2026-366509

mint is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')CVE-2026-59249 Published Jul 23, 2026

Medium Risk

This Affects:

mint

0.1.0 - 1.9.2

Fixed in 1.9.3

Are you affected? Scan for Free

TL;DR

Affected versions of mint are vulnerable to HTTP response smuggling in the Mint.HTTP1 chunked response body decoder (decode_body/5). The decoder parses chunk-size lines with Integer.parse(data, 16), which accepts optional leading + or - characters in violation of RFC 7230, where chunk-size must be hexadecimal digits only. Chunk-size lines such as +5, +0, and -0 are accepted by Mint but rejected by RFC-strict intermediaries (proxies, load balancers, or WAFs). On pooled keep-alive HTTP/1 connections, a malicious or attacker-influenced origin can desynchronize Mint and a strict intermediary on response boundaries, inject bytes that Mint attributes to the next legitimate response, and poison the response queue for unrelated in-flight requests on the same connection.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application uses Mint as an HTTP/1 client to talk to remote origins through an RFC-strict intermediary (proxy, load balancer, or WAF) with reused keep-alive connections. Deployments where Mint connects directly to an origin without an intermediary, or does not reuse connections, are not exploitable for response-queue poisoning even on vulnerable versions.