AIKIDO-2026-587838

TL;DR

Mint's HTTP/2 client in Mint.HTTP2 enforces max_header_list_size only on the compressed size of an inbound header block, not on the decoded header list that RFC 9113 bounds. join_cookie_headers/1 copies every cookie value from a response into one new binary before this check runs, so a single HPACK indexed cookie field that costs one byte on the wire can expand through the dynamic table into roughly a gigabyte of allocation for one response. A malicious or compromised HTTP/2 server can repeat this across several responses on one connection to exhaust the memory of the owning process or the whole VM. The fix enforces the size limit against the decoded header list instead of only the compressed wire size.