A malicious HTTP/1 server can send a response that includes a Transfer‑Encoding header where chunked is not the final coding, for example "Transfer‑Encoding: chunked, gzip", on a pooled connection. According to RFC 9112, chunked framing applies only when chunked is the last coding, yet the elixir‑mint Mint client incorrectly applies chunked framing regardless, terminating the body at the terminating zero‑length chunk. The remaining bytes are then parsed as a new response on the same connection, desynchronizing the client and any intermediary. This allows the attacker to poison or hijack responses to subsequent requests sharing that connection, a classic pattern of HTTP request/response smuggling classified as CWE‑444.

Elixir‑Mint Mint v0.1.0 through 1.10.1 are affected. The bug impacts every release before 1.10.2, as noted by the CNA. Applications that reuse Mint connections to an upstream server that can control the Transfer‑Encoding header are potentially impacted.

The CVSS score of 6.3 indicates moderate severity, and the EPSS score is < 1%, indicating a very low but non‑zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to send a crafted response with a non‑final chunked encoding or an ordering that violates RFC 9112 Section 6.3. Upon receipt, Mint ends the body at the zero‑length chunk and treats the following bytes as the next response, enabling data tampering or hijacking on the same connection.