elixir-mint Mint CVE-2026-59249

Exploitation requires all three of the following conditions simultaneously: (1) The Mint client must be using HTTP/1.1 with a keep-alive pooled connection where multiple in-flight requests share the same TCP connection - without connection pooling, there are no co-tenant requests to poison. (2) A strict RFC 7230-compliant intermediary (reverse proxy, CDN, API gateway) must be present in the response path between the origin server and the Mint client - without the intermediary, there is no desynchronization and no injection surface. (3) An attacker must control or be able to influence the origin server's HTTP responses to include RFC-forbidden signed chunk-size headers (+5, +0, or -0). Exploitation is further limited to HTTP/1.1 connections using chunked transfer encoding only; HTTP/2 connections are unaffected. The CVSS 4.0 AT:P metric formally confirms that a specific attack precondition (the particular network topology) is required. What limits exploitation in practice: the attacker must already have meaningful influence over a server that the victim connects to, the network topology with a strict intermediary must be present, and the impact is bounded to responses on the same connection pool rather than arbitrary system access.

The CVSS 4.0 score of 6.3 (Medium) with vector AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N accurately reflects conditional, moderate-impact exploitation. The critical limiting factor is AT:P (Attack Preconditions required in CVSS 4.0 terminology), meaning three specific conditions must align: the Mint client must be using HTTP/1.1 connection pooling, the response path must include a strict RFC-compliant intermediary, and the attacker must be able to influence origin server responses. This is not a broad spray-and-pray attack surface. The impact is limited to response confidentiality (VC:L) and integrity (VI:L) - an attacker can read or corrupt responses destined for other in-flight requests sharing the same connection pool, which is sufficient for session data theft or response injection but does not enable arbitrary code execution. No EPSS data was provided in the intelligence feed; given the niche attack topology and library-specific footprint, real-world mass exploitation risk is low. No CISA KEV listing and no public POC exist, making this a patch-now but not panic-now finding. The vendor's CVSS 4.0 vector and the CVE description are fully consistent - no contradictory signals observed.

An attacker who controls or has compromised an HTTP/1 origin server behind a strict RFC-compliant proxy crafts a chunked HTTP response containing a +0 chunk-size header to terminate the response body early. The strict proxy sees this as an invalid chunk-size and applies its own boundary parsing, while Mint accepts +0 as a valid zero-length terminating chunk, attributing subsequent injected server bytes to the next queued request on the shared keep-alive connection pool. This allows the attacker to inject a fabricated HTTP response body that Mint delivers to a co-tenant application request, potentially stealing session tokens or injecting malicious content into a legitimate response. No public proof-of-concept exploit has been identified at time of analysis.