Response smuggling via unvalidated chunk-size line tails

HTTP response smuggling in Mint before 1.10.1 allows remote attackers to poison queued responses via malformed chunk-size lines. Mint.HTTP1.Parse.chunk_size/1 stops at the first nonhexadecimal byte, and Mint.HTTP1.decode_body/5 discards the unvalidated tail through CRLF. Exploitation requires an attacker-influenced HTTP/1 origin behind a stricter intermediary and reuse of the same pooled keep-alive connection, allowing bytes from one response to be assigned to a later request.