Tr3Bor

A remote HTTP server can cause a denial of service by exhausting memory on the client host. This occurs because two HTTP/1 response-parser states accumulate server data without limits. Specifically, the `decode status line/4` function stores unconsumed data in `conn.buffer` when the status line is incomplete, and the `decode body/5` function does the same for an unterminated chunk-extension line. Both functions wait for a CRLF (Carriage Return Line Feed) sequence that a malicious server may never send, causing `conn.buffer` to be prepended to every subsequent socket message. While a budget exists via `:max header list size`, it only applies to `decode headers/5` and `decode trailer headers/4`, leaving these two states unprotected. An attacker can stream bytes indefinitely until the BEAM node is terminated by the operating system's out-of-memory handler. In the case of chunk-extensions, the attack occurs after a valid status line and header section, potentially bypassing intermediaries that only inspect headers.

An inefficient algorithmic complexity issue allows a remote HTTP server to exhaust CPU resources on the client host, leading to a denial of service. The `parse hex prefix/2` function in `lib/mint/http1/parse.ex` processes hex digits of a chunked response's chunk-size field using an arbitrary-precision accumulator without limiting the digit count. This results in O(N squared) time complexity for processing N digits. Additionally, the `handle data/2` function prepends the `conn.buffer` and re-parses from the beginning for every socket message, which can be exploited by a server sending digits in small packets to repeatedly trigger the high CPU cost. This state is reached after a valid status line and header section, potentially bypassing intermediaries that only inspect headers.