The Mint HTTP/1 implementation parses the chunk-size line of a chunked response using Integer.parse/2, which accepts an optional leading '+' or '-'. RFC 7230 defines chunk-size as one or more hexadecimal digits and forbids any sign prefix. Consequently, a server that sends a chunk-size like '+5' is interpreted by Mint as a five‑byte chunk, while a strict intermediary rejects it. This disagreement desynchronizes the client and the intermediary, allowing a malicious server to inject data that the client attributes to the next legitimate response on the same keep‑alive connection, effectively poisoning the response queue. The result can be data leakage, corrupted responses, or denial of service for unrelated in‑flight requests. The weakness is a classic HTTP response splitting issue, identified as CWE‑444.

The vulnerability affects the Elixir‑Mint library, version 0.1.0 through 1.9.2 inclusive. Any application that uses Mint for HTTP/1 communications on pooled keep‑alive connections and interacts with external servers is potentially exposed.

The CVSS score of 6.3 indicates a moderate severity vulnerability. EPSS score of 0.00301 (<1%) and the flaw not being listed in CISA’s KEV catalog suggest a low probability of current exploitation. However, the attack can be carried out remotely by a server that controls the origin of HTTP responses sent through any pooled keep‑alive connection. Once the desynchronization occurs, subsequent requests made over the shared connection can receive poisoned data. The risk is primarily data integrity and availability for services relying on consistent chunk parsing.