Elixir Mint CVE-2026-82672

Requires all of the following to align: (1) the target application uses Mint (0.1.0 up to but not including 1.10.1) for HTTP/1 over a pooled/shared connection; (2) an RFC-9112-strict intermediary (proxy, CDN, or load balancer) sits between Mint and the origin so the two parsers can disagree on chunk boundaries; and (3) the attacker controls or can influence an HTTP/1 server's chunked responses to inject a malformed chunk-size line (hex digits followed by arbitrary non-';' bytes, e.g. '5ZZZZZ', '5 9', or '0ZZZZ'). Limiting factors: exploitation is unauthenticated (PR:N) but non-trivial (AT:P) because it depends on this specific desync topology; a connection not shared/pooled, or the absence of a strict intermediary, largely neutralizes the impact. Impact is confined to confidentiality/integrity of responses on the poisoned connection (VC:L/VI:L), with no availability or code-execution effect.

This is a moderate-severity HTTP/1 response-smuggling flaw (CWE-444) that is a real but conditional priority rather than a drop-everything issue. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N) scores 6.3: network-reachable and unauthenticated, but critically gated by AT:P (Attack Requirements: Present), which correctly captures that exploitation is not fire-and-forget - it needs a specific topology (a malicious/attacker-influenced HTTP/1 server, a strict RFC-9112 intermediary in the path, and a pooled/shared connection). Impact is limited to Low confidentiality and Low integrity with no availability or subsequent-system impact, consistent with response-queue poisoning that can misattribute or corrupt responses to co-tenant requests rather than granting code execution. No EPSS score, no CISA KEV listing, and no public POC are present in the provided intelligence, so there is no evidence of active or automated exploitation; the risk is opportunistic/targeted at best. Note a clear data conflict: the input Tags include 'RCE', but nothing in the description, CWE-444, or the patch supports remote code execution - this is request/response smuggling only, and the 'RCE' tag should be disregarded. A patch (mint 1.10.1) is available and remediation is straightforward, which lowers residual risk for maintained deployments.

An Elixir application using Mint (directly or via Finch/Req/Tesla) makes HTTP/1 requests through a strict intermediary (proxy/CDN/load balancer) over a pooled connection to a server the attacker controls or can influence. The attacker returns a chunked response whose chunk-size line contains trailing non-hex bytes (e.g. '5ZZZZZ' or '0ZZZZ'); the strict intermediary and Mint disagree on where the response ends, letting attacker-planted bytes be dequeued as the response to a different, legitimate request sharing that connection. No public exploit code is identified at time of analysis, and the AT:P attack requirement means the specific intermediary/pooling topology must exist.