Elixir Mint CVE-2026-94194

Requires (1) Mint acting as the HTTP/1 client against a server whose responses the attacker controls or can inject (a malicious origin server or MITM), (2) a pooled/keep-alive HTTP/1 connection reused for subsequent requests, and (3) a response that triggers the framing bug - specifically Transfer-Encoding listing 'chunked' as the FIRST (not final) coding, e.g. 'Transfer-Encoding: chunked, gzip', or an HTTP/1.0 response (final or 1xx) carrying Transfer-Encoding with Connection: keep-alive. Limiting factors: this is a reverse-trust scenario (the attacker must influence server framing, not merely reach Mint), it only affects HTTP/1 with connection reuse, and it is fixed in Mint 1.11.0. HTTP/2 usage and non-pooled/close-after-response connections are not affected.

This is a reverse-trust HTTP/1 response-smuggling flaw (CWE-444): a MALICIOUS or attacker-influenced HTTP/1 server, not a client-side attacker, is required to desynchronize an intermediary from the Mint client over a pooled/keep-alive connection. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N, 6.3) is internally consistent with the description: network reachable, no authentication to Mint, but with an Attack Requirement (AT:P) reflecting the need for connection pooling plus attacker control of server framing and a following request to poison. The 'PR:N' correctly describes that no credentials against Mint are needed, but exploitation is gated by the attacker already controlling (or MITM-influencing) the origin server response - a meaningful precondition. No EPSS score, no CISA KEV listing, and no public POC were provided, so per the precision rules this is 'no public exploit identified at time of analysis.' The Transfer-Encoding parsing bug is confirmed by a vendor advisory (GHSA-gvrc-75rc-7gj9) and two patch commits, so the technical validity is well-established, but real-world weaponization is unproven. Net: a genuine correctness/security bug with a credible patch, but real-world priority is tempered by the reverse-trust prerequisite (you must already talk to a hostile/compromised HTTP/1 server through a shared pooled connection), the niche Elixir footprint, and the absence of exploitation signals. Treat as a should-patch library update rather than an emergency.

An attacker who controls or can influence an HTTP/1 origin server (or sits as a malicious intermediary) returns a response with a header such as 'Transfer-Encoding: chunked, gzip' or an HTTP/1.0 keep-alive response carrying Transfer-Encoding; Mint stops the body at the zero-length chunk while an RFC-compliant intermediary reads to connection close, desynchronizing the two. On the same pooled connection, Mint then mis-parses leftover bytes as the response to the next request, letting the attacker poison or substitute responses delivered to other requests sharing that connection. No public exploit code was provided, and success requires the connection-pooling and framing conditions captured by CVSS AT:P.