AIKIDO-2026-926627

TL;DR

Mint's HTTP/1 client in Mint.HTTP1 frames a response as chunked whenever chunked is the first listed Transfer-Encoding token instead of the last, and keeps an HTTP/1.0 keep-alive connection open even when it carries Transfer-Encoding. A pooled connection to a malicious or compromised server can send a Transfer-Encoding: chunked, gzip response, or a faulty HTTP/1.0 response, framed differently than an RFC 9112 compliant intermediary expects. Mint ends the body at its own chunk boundary and parses the remaining bytes as the response to the next request on the same connection, poisoning it with untrusted content. The fix frames the body as chunked only when chunked is the final transfer coding and closes the connection after a faulty HTTP/1.0 response.