CVE-2026-48861

CRLF injection in HTTP/1 request line via unvalidated method in Mint

Published Jun 2, 2026 CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Description

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in elixir-mint Mint allows HTTP Request Splitting and HTTP Request Smuggling.

In lib/mint/http1/request.ex, the encode_request_line/2 function splices the caller-supplied method and target arguments directly into the HTTP/1 request line without any character validation: [method, ?\s, target, " HTTP/1.1\r\n"]. An application that forwards attacker-controlled input as the HTTP method or target to Mint.HTTP.request/5 is therefore exposed to request-line CRLF injection: the attacker can terminate the request line early, inject arbitrary headers, and smuggle an entirely separate pipelined HTTP request onto the same TCP connection.

Mint 1.7.0 introduced validate_request_target/2, which rejects CRLF and other control characters in the target by default and closes the path/query vector unless the caller opts out via skip_target_validation: true. The method field remains unvalidated, so the method-based injection is exploitable under the default Mint configuration on all versions.

This issue affects mint: from 0.1.0 before 1.9.0.

Analysis

Technical impact

The vulnerability arises from the Mint HTTP library’s encode_request_line/2 function, which concatenates the caller‑supplied method and target into the HTTP/1 request line without validating for CRLF or other control characters. An attacker able to influence either value can terminate the request line early and inject arbitrary headers, enabling HTTP request splitting or smuggling. The issue is present in all Mint releases from 0.1.0 up to, but not including, 1.9.0. No additional logic was added to reject CRLF in the method field even after Mint 1.7.0 introduced target validation, leaving the method field permanently unvalidated under default configuration.

Affected Systems

Elixir Mint (version 0.1.0 through 1.8.x). Applications that forward external input to Mint.HTTP.request/5 without sanitizing the method or target strings, such as HTTP reverse proxies or forwarders built with Mint, are susceptible.

Risk and Exploitability

The CVSS score of 2.1 reflects a low‑severity impact. The EPSS value is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a crafted HTTP method or target string; therefore the risk is limited to contexts where such input is propagated to Mint without prior validation. No direct attack scenario was specified in the original disclosure.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

elixir-mint

mint

unaffected

Version	Status	Constraints
`0.1.0`	affected	< 1.9.0

elixir-mint

mint

unaffected

Version	Status	Constraints
`8db1acff30b6a9433762c18b1e1f891b8c1f74f7`	affected	< fad091454cbb7449b19edb8e1fee12ca7cf28c3a

No data.

Vendor Product Versions

Elixir-mint

Mint

Version	Status	Scheme	Platform
`[0.1.0,1.9.0)`	affected	semver	—
`[8db1acff30b6a9433762c18b1e1f891b8c1f74f7,fad091454cbb7449b19edb8e1fee12ca7cf28c3a)`	affected	code_commit	—

Elixir-mint

Mint

Version	Status	Scheme	Platform
`[0.1.0,1.9.0)`	affected	semver	—

Elixir-mint

Mint

Version	Status	Scheme	Platform
`[8db1acff30b6a9433762c18b1e1f891b8c1f74f7,fad091454cbb7449b19edb8e1fee12ca7cf28c3a)`	affected	code_commit	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Mint to version 1.9.0 or newer, which rejects CRLF characters in the request target and mitigates the vulnerability.
Validate the HTTP method argument before calling Mint.HTTP.request, rejecting CRLF or other control characters to prevent method‑based injection.
Avoid setting skip_target_validation to true for calls that may receive externally supplied method or target strings; use the default validation or set the flag to false.

Generated by OpenCVE AI on June 2, 2026 at 17:06 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-2pg6-44cx-c49v	mint has potential CRLF injection in its HTTP request line via unvalidated `method`/`target`

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.167% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://cna.erlef.org/cves/CVE-2026-48861.html
https://github.com/elixir-mint/mint/commit/fad091454cbb7449b19edb8e1fee12ca7cf28c3a
https://github.com/elixir-mint/mint/security/advisories/GHSA-2pg6-44cx-c49v
https://osv.dev/vulnerability/EEF-CVE-2026-48861

History

Jun 2, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 2, 2026 3:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in elixir-mint Mint allows HTTP Request Splitting and HTTP Request Smuggling. In lib/mint/http1/request.ex, the encode_request_line/2 function splices the caller-supplied method and target arguments directly into the HTTP/1 request line without any character validation: [method, ?\s, target, " HTTP/1.1\r\n"]. An application that forwards attacker-controlled input as the HTTP method or target to Mint.HTTP.request/5 is therefore exposed to request-line CRLF injection: the attacker can terminate the request line early, inject arbitrary headers, and smuggle an entirely separate pipelined HTTP request onto the same TCP connection. Mint 1.7.0 introduced validate_request_target/2, which rejects CRLF and other control characters in the target by default and closes the path/query vector unless the caller opts out via skip_target_validation: true. The method field remains unvalidated, so the method-based injection is exploitable under the default Mint configuration on all versions. This issue affects mint: from 0.1.0 before 1.9.0.
Title		CRLF injection in HTTP/1 request line via unvalidated method in Mint
First Time appeared		Elixir-mint Elixir-mint mint
Weaknesses		CWE-93
CPEs		cpe:2.3:a:elixir-mint:mint::::::::
Vendors & Products		Elixir-mint Elixir-mint mint
References		https://cna.erlef.org/cves/CVE-2026-48861.html https://github.com/elixir-mint/mint/commit/fad091454cbb7449b19edb8e1fee12ca7cf28c3a https://github.com/elixir-mint/mint/security/advisories/GHSA-2pg6-44cx-c49v https://osv.dev/vulnerability/EEF-CVE-2026-48861
Metrics		cvssV4_0 `{'score': 2.1, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N'}`