AIKIDO-2026-56333
mint is vulnerable to Inefficient Algorithmic Complexity
63
Medium Risk
This Affects:
mintTL;DR
Mint's HTTP/1 parser reads a chunked response chunk-size field by collecting hex digits with no length limit. As bytes arrive, it re-parses the growing buffer, so a long run of hex characters makes the work grow quadratically, exhausting CPU and crashing the process with an uncaught error. A client that fetches an untrusted URL can hit this via a malicious server. The fix limits the chunk-size field to a fixed number of hexadecimal digits.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and use Mint as an HTTP/1 client against untrusted servers.
Background info
mint is vulnerable to Inefficient Algorithmic Complexity in versions 1.9.3 - 1.9.3.
How to fix this
Upgrade the mint library to the patch version.
Links
Other
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.