CVE-2026-59249

Name of the Vulnerable Software and Affected Versions elixir-mint versions 0.1.0 through 1.9.2

Description An HTTP response smuggling issue exists due to the inconsistent interpretation of HTTP requests. A malicious HTTP/1 server can desynchronize a strict intermediary and the Mint client on a pooled connection, leading to response-queue poisoning for subsequent requests sharing that connection. The decode body() function in lib/mint/http1.ex uses Integer.parse(data, 16) to parse the chunk-size line of a Transfer-Encoding: chunked response. While RFC 7230 forbids sign prefixes for chunk-size, Integer.parse/2 accepts leading + or - signs. Consequently, a chunk-size line of +5 is treated as a five-byte chunk, and +0 or -0 are treated as terminating zero-length chunks, ending the message body prematurely. An RFC-strict intermediary rejects these forms, causing a disagreement on response boundaries. On pooled keep-alive connections, an attacker-influenced origin can inject bytes that the client attributes to the next legitimate response, corrupting responses for unrelated in-flight requests. This requires a topology where an RFC-strict HTTP/1 intermediary (such as a proxy, load balancer, or WAF) is positioned between the Mint client and the origin, and connections are reused.

Recommendations Update elixir-mint to version 1.9.3 or later.