pleroma/changelog.d/mint-1.11.0.security at e7b88cd65241dff9b13f822d024825e7714b395d - hj/pleroma - Forgejo

hj/pleroma

Phantasm e7b88cd652

Sec: Update mint to version 1.11.0

Fixes:
  mint 1.10.0 - EEF-CVE-2026-92103 (MEDIUM)
    aka: CVE-2026-92103, GHSA-q95c-ccq6-j5j6
    Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size
    https://osv.dev/vulnerability/EEF-CVE-2026-92103

  mint 1.10.0 - EEF-CVE-2026-82672 (MEDIUM)
    aka: CVE-2026-82672, GHSA-rj5m-69wp-cxq9
    Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connections
    https://osv.dev/vulnerability/EEF-CVE-2026-82672

  mint 1.10.0 - EEF-CVE-2026-91043 (HIGH)
    aka: CVE-2026-91043, GHSA-9x8p-qrf4-jq7g
    HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memory
    https://osv.dev/vulnerability/EEF-CVE-2026-91043

  mint 1.10.0 - EEF-CVE-2026-94194 (MEDIUM)
    aka: CVE-2026-94194, GHSA-gvrc-75rc-7gj9
    Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediaries
    https://osv.dev/vulnerability/EEF-CVE-2026-94194

2026-10-21 11:27:55 +02:00

1 line

65 B

Text

Raw Blame History

Update mint to version 1.11.0 resolving multiple vulnerabilities