Eric Meadows-Jönsson

Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size

Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediaries

HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memory

Refresh tokens accepted as private repository credentials at the CDN

Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connections

httpc does not bound server-supplied numeric header values before integer conversion

eldap does not bound the port component of a referral URL before integer conversion

snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fields

uri_string does not bound the port component of a URI before integer conversion

Explicit organization scopes survive token refresh after membership ends