AIKIDO-2026-996449
mint is vulnerable to Allocation of Resources Without Limits or Throttling
82
High Risk
This Affects:
mintTL;DR
Mint's HTTP/1 parser appends every parsed response header and every chunked trailer header into an unbounded per-request list. A malicious server can stream header or trailer lines indefinitely without sending the terminating blank line, so the list and its memory grow until the client process crashes. The behavior is reachable by any client that connects to an untrusted server. The fix bounds the accumulated header and trailer data.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use Mint as an HTTP/1 client against untrusted servers.
Background info
mint is vulnerable to Allocation of Resources Without Limits or Throttling in versions 0.1.0 - 1.9.1.
How to fix this
Upgrade the mint library to the patch version.
Links
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.