The vulnerability arises from the Mint HTTP library’s encode_request_line/2 function, which concatenates the caller‑supplied method and target into the HTTP/1 request line without validating for CRLF or other control characters. An attacker able to influence either value can terminate the request line early and inject arbitrary headers, enabling HTTP request splitting or smuggling. The issue is present in all Mint releases from 0.1.0 up to, but not including, 1.9.0. No additional logic was added to reject CRLF in the method field even after Mint 1.7.0 introduced target validation, leaving the method field permanently unvalidated under default configuration.

Elixir Mint (version 0.1.0 through 1.8.x). Applications that forward external input to Mint.HTTP.request/5 without sanitizing the method or target strings, such as HTTP reverse proxies or forwarders built with Mint, are susceptible.

The CVSS score of 2.1 reflects a low‑severity impact. The EPSS value is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a crafted HTTP method or target string; therefore the risk is limited to contexts where such input is propagated to Mint without prior validation. No direct attack scenario was specified in the original disclosure.