Skip to main content
cve.nowby Sazabi
← Hex
HexPackage

mint

14 known vulnerabilities (6 high, 7 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
14 · 6 high, 7 medium, 1 low
Registry
Hex

Advisories 14

  • CVE-2026-94194Medium 6.3

    Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediaries

    Affected: from 0.1.0, fixed in 1.10.2.

  • CVE-2026-92103Medium 6.3

    Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size

    Affected: from 0.1.0, fixed in 1.10.2.

  • HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memory

    Affected: from 1.1.0, fixed in 1.10.2.

  • CVE-2026-82672Medium 6.3

    Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connections

    Affected: from 0.1.0, fixed in 1.10.1; from 0.1.0, fixed in 1.10.1.

  • Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS

    Affected: from 0.1.0, fixed in 1.10.0; from 0.1.0, fixed in 1.10.0.

  • CVE-2026-82729Medium 6.3

    Quadratic chunk-size parsing in Mint.HTTP1.Parse allows CPU-exhaustion DoS

    Affected: from 1.9.3, fixed in 1.10.0; from 1.9.3, fixed in 1.10.0.

  • CVE-2026-59249Medium 6.3

    Sign-tolerant HTTP/1 chunk-size parser in Mint enables response smuggling against strict intermediaries on pooled connections

    Affected: from 0.1.0, fixed in 1.9.3; from 0.1.0, fixed in 1.9.3.

  • CVE-2026-59246Medium 6.3

    Zero-length HTTP/2 CONTINUATION frames bypass Mint's header-block byte-size cap and exhaust client memory

    Affected: from 0.1.0, fixed in 1.9.2; from 0.1.0, fixed in 1.9.2.

  • Unbounded HTTP/1 response-header and chunked-trailer accumulation in Mint causes memory-exhaustion DoS

    Affected: from 0.1.0, fixed in 1.9.2; from 0.1.0, fixed in 1.9.2.

  • mint buffers an entire chunked response chunk in memory in Mint.HTTP1.decode_body/5

    Affected: from 0.5.0, fixed in 1.9.1; from 0.5.0, fixed in 1.9.1.

  • CVE-2026-49753Medium 6.3

    HTTP response smuggling in Mint HTTP/1 client via lenient Content-Length parsing

    Affected: from 0.1.0, fixed in 1.9.0; fixed in 1.9.0; from 0.1.0, fixed in 1.9.0.

  • HTTP/2 CONTINUATION flood in Mint client via unbounded header-block accumulation

    Affected: from 0.1.0, fixed in 1.9.0; fixed in 1.9.0; from 0.1.0, fixed in 1.9.0.

  • Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrency

    Affected: from 0.2.0, fixed in 1.9.0; from 0.2.0, fixed in 1.9.0.

  • CRLF injection in HTTP/1 request line via unvalidated method in Mint

    Affected: from 0.1.0, fixed in 1.9.0; fixed in 1.9.0; from 0.1.0, fixed in 1.9.0.