Eric Meadows-Jönsson

Explicit organization scopes survive token refresh after membership ends

OAuth token exchange grants repository scopes for organizations the principal cannot access

Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of service

HTTP/2 CONTINUATION flood in Mint client via unbounded header-block accumulation

HTTP response smuggling in Mint HTTP/1 client via lenient Content-Length parsing

Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrency

CRLF injection in HTTP/1 request line via unvalidated method in Mint

Sign-tolerant HTTP/1 chunk-size parser in Mint enables response smuggling against strict intermediaries on pooled connections

Zero-length HTTP/2 CONTINUATION frames bypass Mint's header-block byte-size cap and exhaust client memory

Unbounded HTTP/1 response-header and chunked-trailer accumulation in Mint causes memory-exhaustion DoS