The vulnerability arises because Mint's HTTP/1 Content-Length parser accepts signed integers (e.g., '+0') as valid lengths, whereas RFC 7230 disallows sign characters in Content-Length headers. A strict fronting proxy or load balancer will reject or reframe such headers, but Mint treats them as valid zero-length bodies. When Mint reuses connections (keep-alive, pipelining, or connection pooling), this mismatch in parsing can cause response framing desynchronization, enabling an attacker-controlled HTTP/1 server upstream to smuggle responses and leak data across different requesters sharing the connection. This affects mint version 0.1.0 and earlier versions before 1.9.0.

An attacker controlling an upstream HTTP/1 server can exploit the inconsistent Content-Length parsing to desynchronize response framing on shared connections. This can lead to response smuggling, where bytes from one response are incorrectly attributed to another consumer's response stream, potentially leaking sensitive data across trust boundaries. The impact is limited to scenarios where the same Mint connection is shared across different requesters.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is indicated in the provided data. Users should monitor vendor communications for updates and consider avoiding reuse of connections in affected versions until a fix is available.