CVE-2026-94194
MediumCVSS 6.3Summary
An HTTP Request/Response Smuggling vulnerability in elixir-mint allows a malicious HTTP/1 server to desynchronize an intermediary and the Mint client on a pooled connection, poisoning responses to subsequent requests sharing the connection. The issue stems from selecting chunked framing when chunked is not the final coding in Transfer-Encoding, and from keeping the connection open after an HTTP/1.0 response with Transfer-Encoding and Connection: keep-alive.
Risk Assessment
An attacker can poison responses for subsequent requests sharing the same connection, potentially leading to data disclosure or unwanted operations. The vulnerability affects mint versions from 0.1.0 before 1.11.0.
Recommendation
Update the elixir-mint library to version 1.11.0 or later. Analyze whether your application uses pooled connections and could be exposed to response poisoning.
Other vulnerabilities in elixir-mint
See all- CVE-2026-92103Medium
An Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint allows a malicious HTTP/2 server to make the client hold up to about 16 MiB per connection in frames it should reject. Mint compares a frame with max_frame_size only after the whole declared payload arrives, and a server can declare a length up to 16,777,215 bytes and withhold the last byte.
- CVE-2026-82729Medium
Inefficient Algorithmic Complexity vulnerability in elixir-mint mint allows a remote HTTP server to exhaust CPU on the client host and cause a denial of service. parse_hex_prefix/2 in lib/mint/http1/parse.ex folds each hex digit of a chunked response's chunk-size field into an arbitrary-precision accumulator with acc * 16 + digit and imposes no limit on the digit count. Because the accumulator grows without bound, the multiplication is not constant time and one pass over N digits costs O(N squared). handle_data/2 prepends conn.buffer and re-parses from the start on every socket message, so a server that dribbles the digits out in small packets makes the client pay that cost repeatedly. A run of roughly 512,000 hex digits costs over ten seconds of CPU in a single pass, measured on stock defaults. The parser reaches this state after a valid status line and a complete, valid header section, so an intermediary inspecting only headers sees an ordinary 200 response. This issue affects mint: from 1.9.3 before 1.10.0.
Original NVD description (English source)
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize an intermediary and the Mint client on a pooled connection, poisoning the responses to subsequent requests that share the connection. message_body/1 in lib/mint/http1.ex selects chunked framing when chunked is the first coding listed in a response's Transfer-Encoding fields. RFC 9112 section 6.3 applies chunked framing only when chunked is the final coding, and otherwise reads the body until the server closes the connection. For a response such as Transfer-Encoding: chunked, gzip, an intermediary that follows the RFC treats every byte up to the close as the body, while Mint ends the body at the zero-length chunk and parses the remaining bytes as the response to the next request on the connection. Mint also keeps the connection open after an HTTP/1.0 response, final or 1xx, that carries Transfer-Encoding and Connection: keep-alive. RFC 9112 section 6.1 requires treating the framing of such a message as faulty and closing the connection after it, so bytes after its chunked body are parsed as the response to the next request in the same way. This issue affects mint: from 0.1.0 before 1.11.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS