AIKIDO-2026-755588

TL;DR

Affected versions of mint are vulnerable to an unbounded-memory denial of service in the Mint.HTTP1 chunked response body decoder (decode_body/5 and add_body_to_buffer/2). When processing a Transfer-Encoding: chunked response, the library buffers every partial fragment of the current chunk in memory and does not emit data to the caller until the full declared chunk length has been received. Because chunk sizes are parsed from the server with no upper bound, a malicious or compromised remote server can announce an enormous chunk (for example, a size line of 7FFFFFFF, about 2 GiB) and then dribble body bytes without ever completing it, forcing the client to accumulate unbounded memory until an out-of-memory condition occurs. Unlike the content-length path, which streams data immediately, the chunked path gives callers no way to observe or bound memory growth.