AIKIDO-2026-567768

TL;DR

Mint's HTTP/2 frame decoder in Mint.HTTP2.Frame only compares a received frame's payload size against max_frame_size after the full payload has already been pattern-matched into a binary, not against the declared length in the 9-byte frame header. A malicious or compromised HTTP/2 server can advertise a frame far larger than the negotiated max_frame_size and stream it slowly, so Mint keeps accumulating bytes in the per connection buffer while the decoder returns an incomplete frame signal. The buffer for a single connection can grow to roughly 16 MiB, about 1024 times the advertised limit, and stay there indefinitely, exhausting memory on hosts with many open connections. The fix checks the declared frame length against max_frame_size before buffering the payload.