elixir-mint vulnerabilities

An HTTP Request/Response Smuggling vulnerability in elixir-mint allows a malicious HTTP/1 server to desynchronize an intermediary and the Mint client on a pooled connection, poisoning responses to subsequent requests sharing the connection. The issue stems from selecting chunked framing when chunked is not the final coding in Transfer-Encoding, and from keeping the connection open after an HTTP/1.0 response with Transfer-Encoding and Connection: keep-alive.

An Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint allows a malicious HTTP/2 server to make the client hold up to about 16 MiB per connection in frames it should reject. Mint compares a frame with max_frame_size only after the whole declared payload arrives, and a server can declare a length up to 16,777,215 bytes and withhold the last byte.

Inefficient Algorithmic Complexity vulnerability in elixir-mint mint allows a remote HTTP server to exhaust CPU on the client host and cause a denial of service. parse_hex_prefix/2 in lib/mint/http1/parse.ex folds each hex digit of a chunked response's chunk-size field into an arbitrary-precision accumulator with acc * 16 + digit and imposes no limit on the digit count. Because the accumulator grows without bound, the multiplication is not constant time and one pass over N digits costs O(N squared). handle_data/2 prepends conn.buffer and re-parses from the start on every socket message, so a server that dribbles the digits out in small packets makes the client pay that cost repeatedly. A run of roughly 512,000 hex digits costs over ten seconds of CPU in a single pass, measured on stock defaults. The parser reaches this state after a valid status line and a complete, valid header section, so an intermediary inspecting only headers sees an ordinary 200 response. This issue affects mint: from 1.9.3 before 1.10.0.