CVE-2026-59249

Sign-tolerant HTTP/1 chunk-size parser in Mint enables response smuggling against strict intermediaries on pooled connections

View on CVE.org

Published Jul 16, 2026 CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Description

Inconsistent interpretation of HTTP requests (HTTP response smuggling) vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on the same pooled connection, enabling response-queue poisoning against subsequent requests that share the connection.

The Mint.HTTP1.decode_body/5 function in lib/mint/http1.ex parses the chunk-size line of a Transfer-Encoding: chunked response with Integer.parse(data, 16). RFC 7230 defines chunk-size = 1*HEXDIG and forbids any sign prefix, but Integer.parse/2 accepts an optional leading + or -. A chunk-size line of +5 is accepted as a five-byte chunk; lines of +0 and -0 are accepted as the terminating zero-length chunk and end the message body early.

An RFC-strict intermediary in the response path rejects these forms, so the intermediary and the Mint client disagree on where one response ends and the next begins. On a pooled keep-alive connection, an attacker-influenced origin can inject bytes that the client attributes to the next legitimate response on the same connection, poisoning the response queue and corrupting the responses returned to unrelated in-flight requests.

This issue affects mint: from 0.1.0 before 1.9.3.

Analysis

Technical impact

The Mint HTTP/1 implementation parses the chunk-size line of a chunked response using Integer.parse/2, which accepts an optional leading '+' or '-'. RFC 7230 defines chunk-size as one or more hexadecimal digits and forbids any sign prefix. Consequently, a server that sends a chunk-size like '+5' is interpreted by Mint as a five‑byte chunk, while a strict intermediary rejects it. This disagreement desynchronizes the client and the intermediary, allowing a malicious server to inject data that the client attributes to the next legitimate response on the same keep‑alive connection, effectively poisoning the response queue. The result can be data leakage, corrupted responses, or denial of service for unrelated in‑flight requests. The weakness is a classic HTTP response splitting issue, identified as CWE‑444.

Affected Systems

The vulnerability affects the Elixir‑Mint library, version 0.1.0 through 1.9.2 inclusive. Any application that uses Mint for HTTP/1 communications on pooled keep‑alive connections and interacts with external servers is potentially exposed.

Risk and Exploitability

The CVSS score of 6.3 indicates a moderate severity vulnerability. EPSS score of 0.00301 (<1%) and the flaw not being listed in CISA’s KEV catalog suggest a low probability of current exploitation. However, the attack can be carried out remotely by a server that controls the origin of HTTP responses sent through any pooled keep‑alive connection. Once the desynchronization occurs, subsequent requests made over the shared connection can receive poisoned data. The risk is primarily data integrity and availability for services relying on consistent chunk parsing.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

elixir-mint

mint

unaffected

Version	Status	Constraints
`0.1.0`	affected	< 1.9.3

elixir-mint

mint

unaffected

Version	Status	Constraints
`60089586ec7adc9fddb09f69a2f5919ba9ac7f33`	affected	< fc7d16538db7e40b56ed489f08683225cb0197fa

No data.

Vendor Product Versions

Elixir-mint

Mint

Version	Status	Scheme	Platform
`[0.1.0,1.9.3)`	affected	semver	—

Elixir-mint

Mint

Version	Status	Scheme	Platform
`[60089586ec7adc9fddb09f69a2f5919ba9ac7f33,fc7d16538db7e40b56ed489f08683225cb0197fa)`	affected	code_commit	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the elixir‑mint library to version 1.9.3 or later, which contains a fix that rejects signed chunk-size values.
If an upgrade is not immediately possible, configure any HTTP proxies or intermediate devices to reject signed chunk-size values in chunked responses, thereby preventing desynchronization.
For applications that cannot be patched or cannot modify proxy behavior, disable or restrict the use of HTTP/1 pooled keep‑alive connections to trusted servers only, or enforce a strict RFC‑compliant chunk-size parser in the application logic.

Generated by OpenCVE AI on July 31, 2026 at 02:04 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.524% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://cna.erlef.org/cves/CVE-2026-59249.html
https://github.com/elixir-mint/mint/commit/fc7d16538db7e40b56ed489f08683225cb0197fa
https://github.com/elixir-mint/mint/security/advisories/GHSA-x3x7-96vm-6h2w
https://osv.dev/vulnerability/EEF-CVE-2026-59249

History

Jul 16, 2026 1:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 16, 2026 12:15 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Inconsistent interpretation of HTTP requests (HTTP response smuggling) vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on the same pooled connection, enabling response-queue poisoning against subsequent requests that share the connection. The Mint.HTTP1.decode_body/5 function in lib/mint/http1.ex parses the chunk-size line of a Transfer-Encoding: chunked response with Integer.parse(data, 16). RFC 7230 defines chunk-size = 1*HEXDIG and forbids any sign prefix, but Integer.parse/2 accepts an optional leading + or -. A chunk-size line of +5 is accepted as a five-byte chunk; lines of +0 and -0 are accepted as the terminating zero-length chunk and end the message body early. An RFC-strict intermediary in the response path rejects these forms, so the intermediary and the Mint client disagree on where one response ends and the next begins. On a pooled keep-alive connection, an attacker-influenced origin can inject bytes that the client attributes to the next legitimate response on the same connection, poisoning the response queue and corrupting the responses returned to unrelated in-flight requests. This issue affects mint: from 0.1.0 before 1.9.3.
Title		Sign-tolerant HTTP/1 chunk-size parser in Mint enables response smuggling against strict intermediaries on pooled connections
First Time appeared		Elixir-mint Elixir-mint mint
Weaknesses		CWE-444
CPEs		cpe:2.3:a:elixir-mint:mint::::::::
Vendors & Products		Elixir-mint Elixir-mint mint
References		https://cna.erlef.org/cves/CVE-2026-59249.html https://github.com/elixir-mint/mint/commit/fc7d16538db7e40b56ed489f08683225cb0197fa https://github.com/elixir-mint/mint/security/advisories/GHSA-x3x7-96vm-6h2w https://osv.dev/vulnerability/EEF-CVE-2026-59249
Metrics		cvssV4_0 `{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}`