Eric Meadows-Jönsson

OAuth token exchange grants repository scopes for organizations the principal cannot access

Sign-tolerant HTTP/1 chunk-size parser in Mint enables response smuggling against strict intermediaries on pooled connections

Zero-length HTTP/2 CONTINUATION frames bypass Mint's header-block byte-size cap and exhaust client memory

Unbounded HTTP/1 response-header and chunked-trailer accumulation in Mint causes memory-exhaustion DoS

mint buffers an entire chunked response chunk in memory in Mint.HTTP1.decode_body/5

Unauthenticated denial-of-service via unbounded HPACK integer decoding in hpax

Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of service

HTTP response smuggling in Mint HTTP/1 client via lenient Content-Length parsing

HTTP/2 CONTINUATION flood in Mint client via unbounded header-block accumulation

Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrency