EUVD-2026-44909Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network attack vector (AV:N), high complexity (AC:H) for required topology; no privileges or UI needed; scope changed (S:C) as response poisoning corrupts data for other users on the same connection pool; limited C and I impact only.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
2DescriptionCVE.org
Inconsistent interpretation of HTTP requests (HTTP response smuggling) vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on the same pooled connection, enabling response-queue poisoning against subsequent requests that share the connection.
The Mint.HTTP1.decode_body/5 function in lib/mint/http1.ex parses the chunk-size line of a Transfer-Encoding: chunked response with Integer.parse(data, 16). RFC 7230 defines chunk-size = 1*HEXDIG and forbids any sign prefix, but Integer.parse/2 accepts an optional leading + or -. A chunk-size line of +5 is accepted as a five-byte chunk; lines of +0 and -0 are accepted as the terminating zero-length chunk and end the message body early.
An RFC-strict intermediary in the response path rejects these forms, so the intermediary and the Mint client disagree on where one response ends and the next begins. On a pooled keep-alive connection, an attacker-influenced origin can inject bytes that the client attributes to the next legitimate response on the same connection, poisoning the response queue and corrupting the responses returned to unrelated in-flight requests.
This issue affects mint: from 0.1.0 before 1.9.3.
AnalysisAI
Response-queue poisoning in the elixir-mint Mint HTTP/1.1 client library (versions 0.1.0 through before 1.9.3) allows a malicious or attacker-influenced HTTP/1 origin server to desynchronize a strict RFC-compliant intermediary from the Mint client on shared keep-alive pooled connections. The root cause is Mint.HTTP1.decode_body/5 using Elixir's Integer.parse/2 for chunked transfer-encoding chunk-size parsing, which accepts RFC-forbidden leading + or - sign prefixes, causing both parties to disagree on where one HTTP response ends and the next begins. No public exploit has been identified at time of analysis, but a vendor-released patch is available in Mint 1.9.3.
Technical ContextAI
The affected library is elixir-mint Mint (CPE: cpe:2.3:a:elixir-mint:mint), an HTTP client written in Elixir for the BEAM virtual machine. CWE-444 (Inconsistent Interpretation of HTTP Requests - HTTP Request/Response Smuggling) describes the root cause class: two HTTP-processing entities disagree on message boundaries, enabling injection attacks. Specifically, Mint.HTTP1.decode_body/5 in lib/mint/http1.ex called Integer.parse(data, 16) to parse HTTP/1.1 chunked transfer-encoding chunk-size values in hex. Elixir's Integer.parse/2 implements Elixir integer parsing semantics that tolerate an optional leading + or -, but RFC 7230 defines chunk-size = 1*HEXDIG - strictly unsigned hex digits only. This means +5 is parsed as a five-byte chunk, while +0 and -0 are each accepted as a terminating zero-length chunk, ending the message body prematurely. A strict RFC 7230-compliant intermediary in the response path (proxy, CDN, API gateway) rejects these forms and applies different message boundaries than Mint, enabling the desynchronization. The fix (commit fc7d165) replaces Integer.parse/2 with a new Mint.HTTP1.Parse.chunk_size/1 function that validates each character individually as a valid hex digit (0-9, a-f, A-F), explicitly rejecting any sign prefix.
RemediationAI
Upgrade elixir-mint Mint to version 1.9.3 or later, which replaces the vulnerable Integer.parse/2 chunk-size parser with a custom RFC-strict hex-only parser (Mint.HTTP1.Parse.chunk_size/1) that explicitly rejects signed integers. The patch commit is at https://github.com/elixir-mint/mint/commit/fc7d16538db7e40b56ed489f08683225cb0197fa and the advisory at https://github.com/elixir-mint/mint/security/advisories/GHSA-x3x7-96vm-6h2w. Note: the CHANGELOG in the patch commit marks the fix as 'Unreleased,' so confirm version 1.9.3 availability in the Hex.pm package registry before deploying. If immediate upgrade is not feasible, disabling HTTP/1.1 connection pooling and forcing a new TCP connection per request eliminates the response-queue poisoning risk by removing shared connection state; this carries a significant performance penalty (new TLS handshake per request). An alternative architectural control is removing any strict RFC-compliant intermediary from the Mint client's response path, though this requires careful topology review and may reduce other security properties.
Memory exhaustion in the Elixir Mint HTTP/2 client (versions 0.1.0 through 1.8.x) allows a malicious or compromised HTTP
Memory exhaustion in elixir-mint Mint HTTP/2 client (versions 0.2.0 through 1.8.x) allows a malicious HTTP/2 server to c
HTTP response smuggling in the Elixir Mint HTTP client library (versions 0.1.0 through before 1.9.0) allows attacker-con
Uncontrolled memory allocation in the Elixir Mint HTTP client (Mint.HTTP1 module, versions 0.5.0 through 1.9.0) lets a m
Unbounded memory accumulation in the elixir-mint Mint HTTP client library (versions 0.1.0 through <1.10.0) enables a rem
Unbounded memory consumption in the Elixir Mint HTTP client (versions 0.1.0 through 1.9.1) lets a malicious or attacker-
CPU exhaustion via crafted chunked HTTP responses affects the Elixir Mint HTTP client library (versions 1.9.3 through be
Memory exhaustion in elixir-mint's HTTP/2 client library (mint) allows a malicious or attacker-controlled HTTP/2 server
CRLF injection in the elixir-mint Mint HTTP/1.1 client library (versions 0.1.0 through 1.8.x) enables HTTP Request Split
Same weakness CWE-444 – HTTP Request/Response Smuggling
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today