CVE-2026-82672

Received Received - Intake

HTTP Request Smuggling in Mint HTTP Client

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: EEF

Description

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on a pooled connection, enabling response-queue poisoning against subsequent requests that share the connection. Mint.HTTP1.Parse.chunk_size/1 in lib/mint/http1/parse.ex stops at the first non-hexadecimal byte of a chunked response's chunk-size line and returns the remainder unexamined. Mint.HTTP1.decode_body/5 in lib/mint/http1.ex then discards every byte up to the CRLF with Parse.ignore_until_crlf/1, so the accepted grammar is a run of hex digits followed by arbitrary bytes, where RFC 9112 permits only a ;-introduced chunk extension. Lines such as 5ZZZZZ and 5 9 are accepted as chunk size 5, and 0ZZZZ is accepted as the terminating chunk that ends the message body. An RFC-strict intermediary rejects such a line while Mint accepts it, so the two disagree on chunk boundaries and on where the response ends. This issue affects mint: from 0.1.0 before 1.10.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-82672

Affected Vendors & Products

Vendor	Product	Version / Range
elixir-mint	mint	From 0.1.0 (inc) to 1.10.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-444	The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

Executive Summary

This vulnerability is an HTTP Request/Response Smuggling issue in the elixir-mint library. A malicious HTTP/1 server can exploit how Mint parses chunked responses to desynchronize the client and intermediary systems. Mint incorrectly accepts malformed chunk size lines (e.g., '5ZZZZZ' or '5 9') as valid, while strict intermediaries reject them. This causes disagreement on response boundaries, leading to response-queue poisoning for subsequent requests sharing the same connection.

Detection Guidance

This vulnerability involves HTTP request smuggling due to improper parsing of chunked responses in the elixir-mint library. Detection requires inspecting network traffic for malformed HTTP/1 chunked transfer encodings, such as chunk-size lines with non-hexadecimal characters or missing chunk extensions. Use tools like Wireshark or tcpdump to capture and analyze HTTP traffic for anomalies in chunked encoding formats.

Impact Analysis

This vulnerability could allow an attacker to poison the response queue of a shared connection, potentially intercepting or modifying responses intended for other users. This might lead to data leaks, session hijacking, or unauthorized access to sensitive information if the affected system processes malicious requests.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling response-queue poisoning, which may lead to unauthorized data exposure or manipulation. The desynchronization between strict intermediaries and the Mint client could allow attackers to inject malicious responses, compromising data integrity and confidentiality.

Mitigation Strategies

Immediately upgrade the elixir-mint library to version 1.10.1 or later to address the parsing flaw. If upgrading is not possible, consider disabling pooled HTTP/1 connections or implementing strict HTTP/1 parsing at intermediaries to reject malformed chunked encodings. Monitor network traffic for signs of response-queue poisoning or desynchronization between clients and intermediaries.

Hi! I’m here to help you understand CVE-2026-82672. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70