CVE-2026-49754

A vulnerability in the Mint library (versions 0.1.0 through 1.9.2) allows HTTP response smuggling by accepting a plus/minus sign in the chunk-size line of Transfer-Encoding: chunked. A malicious HTTP/1 server can exploit this interpretation mismatch to poison the response queue on a shared keep-alive connection, causing subsequent requests to receive forged responses.

A vulnerability in the mint library (Elixir) allows a malicious HTTP/2 server to make the client buffer up to about 16 MiB per connection in frames it should reject, consuming client memory. This occurs because the frame is compared with the maximum size only after the entire declared payload has arrived, leading to excessive memory usage.

The mint library (Elixir) has a resource allocation vulnerability allowing a malicious HTTP/2 server to exhaust client memory and cause denial of service. Affected versions are from 1.1.0 before 1.10.2.

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on a pooled connection, enabling response-queue poisoning against subsequent requests that share the connection. Mint.HTTP1.Parse.chunk_size/1 stops at the first non-hexadecimal byte of a chunked response's chunk-size line and returns the remainder unexamined, and Mint.HTTP1.decode_body/5 discards bytes up to the CRLF, so lines such as 5ZZZZZ and 5 9 are accepted as chunk size 5, and 0ZZZZ as the terminating chunk. This issue affects mint from 0.1.0 before 1.10.1.

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client host and cause a denial of service. Two HTTP/1 response-parser states accumulate server data without any cap. In lib/mint/http1.ex, decode_status_line/4 stores the unconsumed data in conn.buffer when the status line is incomplete, and decode_body/5 does the same for an unterminated chunk-extension line. Both wait for a CRLF the server never has to send, and conn.buffer is prepended to every subsequent socket message. The :max_header_list_size budget is wired only into decode_headers/5 and decode_trailer_headers/4, so neither of these states is covered by it. A malicious server, or one reached through an attacker-controlled redirect or a fetched URL, streams bytes indefinitely until the BEAM node is killed by the operating system out-of-memory handler. The chunk-extension variant is reached after a valid status line and a complete, valid header section, so an intermediary inspecting only headers sees an ordinary 200 response. This issue affects mint: from 0.1.0 before 1.10.0.

A vulnerability in the Mint library for Elixir allows a remote HTTP/2 server to exhaust client memory by sending an infinite stream of zero-length CONTINUATION frames. The header accumulation mechanism lacks proper protection against this attack, leading to denial of service (DoS).

A vulnerability in the Mint library for Elixir allows a remote HTTP server to exhaust client memory and cause a denial of service (DoS). The HTTP header decoding functions accumulate headers without limits, and the parser has no cap on the number or size of headers, enabling an attacker to stream infinite header lines without a terminating blank line.

A vulnerability in the Mint library (Mint.HTTP1 module) allows a remote server to exhaust client memory by sending a chunked transfer-encoded response with a declared huge chunk size (e.g., 2 GiB) and slowly sending data without ever completing the chunk. The client buffers all received bytes without emitting them to the caller, leading to uncontrolled memory growth and out-of-memory conditions.

Elixir Mint library before version 1.9.0 is vulnerable to HTTP response smuggling. The Content-Length parser accepts + and - signs, violating RFC 7230. An attacker-controlled HTTP/1 server can desynchronize response framing on shared connections.

A vulnerability in the Mint library for Elixir allows an attacker-controlled HTTP/2 server to exhaust client memory via PUSH_PROMISE flooding. The server can create an unlimited number of stream entries without checking the max_concurrent_streams limit, leading to memory exhaustion.