CVE-2026-94194: Mint HTTP/1 Client Response Smuggling Vulnerability
Summary
CVE-2026-94194: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize an intermediary and the Mint client on a pooled connect... Affects mint across 2 version ranges.
>= 0.1.0, < 1.11.0
>= 60089586ec7adc9fddb09f69a2f5919ba9ac7f33, < 2ec8b696b5475ecbdaa87c0098957bca339e17c0
Fixed in 1.11.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mint is an HTTP client library for Elixir that facilitates communication with HTTP servers. It is designed to be efficient and easy to use, providing features such as connection pooling and support for HTTP/1 and HTTP/2 protocols. However, a vulnerability has been identified in versions prior to 1.11.0 that allows for HTTP request/response smuggling, potentially compromising the integrity of responses received by the client.
Vulnerability Detail
The vulnerability arises from an inconsistent interpretation of HTTP requests, specifically in how Mint handles the 'Transfer-Encoding' header. When a response includes 'Transfer-Encoding: chunked, gzip', Mint incorrectly applies chunked framing, leading to a desynchronization between the Mint client and intermediaries. This can allow a malicious server to manipulate responses, causing the Mint client to receive incorrect data for subsequent requests. The issue is exacerbated by Mint's handling of HTTP/1.0 responses that also carry 'Transfer-Encoding' and 'Connection: keep-alive', which should result in the connection being closed but does not in this case.
How To Fix
Minimum fixed version
1.11.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using pooled connections with Mint when communicating with potentially malicious HTTP/1 servers. Additionally, ensure that your application does not reuse connections across requests when interacting with such servers.
Conclusion
CVE-2026-94194 represents a significant vulnerability in the Mint HTTP client, allowing for response smuggling that can lead to data integrity issues. It is crucial for users of the affected versions to update to the patched version 1.11.0 or later to mitigate this risk.
See every vulnerability recorded for mint →
FAQ
CVE-2026-94194 is a vulnerability in the Mint HTTP client that allows for HTTP request/response smuggling due to incorrect handling of the 'Transfer-Encoding' header.
The vulnerability affects Mint versions from 0.1.0 up to, but not including, 1.11.0.
An attacker can manipulate responses sent to the Mint client, leading to incorrect data being processed for subsequent requests, which can compromise application integrity.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By using the Vulert playground, you can check if your application is affected without needing to sign up.
The CVSS score for CVE-2026-94194 is 6.3, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for mint.
