mint Security Advisories - Hex | Ecosyste.ms: Advisories

mint

Small and composable HTTP client.

View on github.com · View on hex.pm

Security Advisories for mint in hex

Medium

20 days ago

Sign-tolerant HTTP/1 chunk-size parser in Mint enables response smuggling against strict intermediaries on pooled connections EEF-CVE-2026-59249

hex mint

Medium

22 days ago

Zero-length HTTP/2 CONTINUATION frames bypass Mint's header-block byte-size cap and exhaust client memory EEF-CVE-2026-59246

hex mint

High

22 days ago

Unbounded HTTP/1 response-header and chunked-trailer accumulation in Mint causes memory-exhaustion DoS EEF-CVE-2026-58229

hex mint

High

26 days ago

mint: Unbounded streams map growth via PUSH_PROMISE without follow-up HEADERS GSA_kwCzR0hTQS1nNTg2LWNjcWYtN3g0cs4ABact

hex mint

High

26 days ago

mint: Unbounded CONTINUATION/HEADERS frame accumulation (CONTINUATION flood) GSA_kwCzR0hTQS0ycDI2LXA0M3gtZmhwOM4ABacs

hex mint

Moderate

26 days ago

mint: Content-Length header accepts non-RFC "+" sign prefix GSA_kwCzR0hTQS1tanF4LWM2ZjYtN3JjMs4ABacr

hex mint

Low

26 days ago

mint has potential CRLF injection in its HTTP request line via unvalidated `method`/`target` GSA_kwCzR0hTQS0ycGc2LTQ0Y3gtYzQ5ds4ABacq

hex mint

High

30 days ago

mint buffers an entire chunked response chunk in memory in Mint.HTTP1.decode_body/5 EEF-CVE-2026-56810

hex mint

Medium

2 months ago

HTTP response smuggling in Mint HTTP/1 client via lenient Content-Length parsing EEF-CVE-2026-49753

hex mint

High

2 months ago

HTTP/2 CONTINUATION flood in Mint client via unbounded header-block accumulation EEF-CVE-2026-49754

hex mint

High

2 months ago

Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrency EEF-CVE-2026-48862

hex mint

Low

2 months ago

CRLF injection in HTTP/1 request line via unvalidated method in Mint EEF-CVE-2026-48861

hex mint

Filter by Severity

High 6 Medium 3 Low 2 Moderate 1