CVE-2026-82672: Mint HTTP/1 Client Response Smuggling Vulnerability
Summary
CVE-2026-82672: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on a pooled c... Affects mint across 2 version ranges.
>= 0.1.0, < 1.10.1
>= 60089586ec7adc9fddb09f69a2f5919ba9ac7f33, < c82377838dc6e275ef40bafa664fbcdf50270c60
Fixed in 1.10.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mint is an HTTP client library for Elixir that provides a simple and efficient way to make HTTP requests. It is designed to be lightweight and performant, allowing developers to build applications that require HTTP communication. However, a vulnerability has been identified in versions of Mint prior to 1.10.1, which can lead to HTTP response smuggling when interacting with strict intermediaries.
Vulnerability Detail
The vulnerability arises from an inconsistent interpretation of HTTP chunk-size lines in the Mint HTTP/1 client. Specifically, the function Mint.HTTP1.Parse.chunk_size/1 fails to validate the entire chunk-size line, allowing non-standard formats to be accepted. This can lead to desynchronization between the Mint client and strict intermediaries, enabling an attacker to poison the response queue on pooled connections. The issue is particularly concerning as it can allow malicious servers to manipulate responses sent to clients, leading to potential data leakage or other security issues.
How To Fix
Minimum fixed version
1.10.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot immediately update the Mint package, consider avoiding the use of pooled connections with strict intermediaries until the update can be applied. This can help mitigate the risk of response smuggling while you work on a more permanent solution.
Conclusion
CVE-2026-82672 is a significant vulnerability in the Mint HTTP/1 client that can lead to response smuggling attacks. It is crucial for developers using Mint to update to version 1.10.1 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in real-time.
See every vulnerability recorded for mint →
FAQ
CVE-2026-82672 is a vulnerability in the Mint HTTP/1 client that allows for HTTP response smuggling due to improper validation of chunk-size lines.
The vulnerability affects Mint versions from 0.1.0 up to, but not including, 1.10.1.
An attacker could exploit this vulnerability to poison the response queue, leading to incorrect responses being sent to clients sharing the same connection.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 6.3, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for mint.
