The vulnerability arises because mint's message_body/1 function incorrectly selects chunked framing when chunked is the first coding in a response's Transfer-Encoding header, contrary to RFC 9112 section 6.3 which requires chunked framing only when chunked is the final coding. For example, a response with Transfer-Encoding: chunked, gzip is handled differently by mint and intermediaries, causing desynchronization. Additionally, mint keeps connections open after HTTP/1.0 responses with Transfer-Encoding and Connection: keep-alive, which RFC 9112 section 6.1 requires to be treated as faulty and closed. These protocol deviations allow a malicious HTTP/1 server to poison responses on pooled connections.

An attacker controlling an HTTP/1 server can exploit this vulnerability to desynchronize the Mint client and intermediaries on a shared connection, leading to response poisoning of subsequent requests. This can cause incorrect or malicious responses to be delivered to clients, potentially impacting application behavior or security. The CVSS 4.0 score is 6.3 (medium severity), indicating a moderate risk with network attack vector, low complexity, and partial impact on confidentiality and integrity.

No explicit patch or official fix is currently documented in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider avoiding use of affected versions (>=0.1.0 <1.11.0) in environments where untrusted HTTP/1 servers are present or where connection pooling is used. Monitoring vendor communications for updates is recommended.