Elixir Mint CVE-2026-49753

Exploitation requires three concurrent conditions to be satisfied simultaneously. First, the Mint client must be operating in a connection-reuse mode - HTTP/1 keep-alive, pipelining, or a pooled connection shared across multiple requesters or application trust boundaries; single-request connections are not exploitable via this primitive. Second, an RFC-strict fronting proxy or load balancer must be present in the request path that enforces Content-Length grammar per RFC 7230 and interprets or reframes sign-prefixed values differently from Mint. Third, the attacker must control or have compromised an upstream HTTP/1 server capable of emitting responses with sign-prefixed Content-Length headers. Exploitation is further limited by PR:N meaning authentication at the Mint client layer is not required, but the attacker must influence the upstream server - not merely the network path. Standard deployments without connection pooling, direct Mint-to-server connections without an interposing proxy, or deployments behind proxies that normalize or strip malformed headers are not vulnerable to response desynchronization.

The CVSS 4.0 base score of 6.3 is derived from a vector of AV:N/AC:L/AT:P/PR:N/UI:N with impact values of VC:N/VI:L/VA:N/SC:L/SI:L/SA:N. The Attack Requirements of Partial (AT:P) is the critical risk-limiting factor: exploitation is not achievable against arbitrary Mint deployments but specifically requires a shared-connection topology (keep-alive, pipelining, or pooled connections across requesters) plus an interposing proxy with strict RFC enforcement and attacker control over an upstream server. The PR:N and UI:N values confirm no authentication or user interaction is required once the topology conditions are met, which is concerning for multi-tenant or SaaS architectures. Impact is bounded: no direct confidentiality loss on the vulnerable system (VC:N), only low integrity impact (VI:L), with low cross-system confidentiality and integrity impact (SC:L/SI:L), reflecting the response-stream leakage rather than arbitrary code execution. This vulnerability is not in CISA KEV and no public exploit code was identified in the provided data; EPSS was not provided. Real-world risk is low-to-moderate for typical single-tenant or direct-connection deployments, but material for multi-tenant applications, API gateways, or reverse-proxy architectures sharing Mint connection pools across users or services.

An attacker who controls or has compromised an upstream HTTP/1 server behind a strict RFC-compliant proxy crafts responses containing a Content-Length header with a sign-prefixed value such as 'Content-Length: +0'. The interposing proxy, enforcing RFC 7230 strictly, interprets this as an invalid or zero-length body and reframes the boundary accordingly, while Mint's parser silently accepts '+0' as a valid zero length and advances its read cursor differently. In a connection pool shared across multiple application users or tenants, the resulting byte misalignment causes data from a subsequent response to be attributed to a different requester's stream, leaking potentially sensitive response content across trust boundaries. No public POC has been identified at time of analysis.