Weakness Type (CWE)

CWE-444 — CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CAPEC

CVSS 4.0 Score

6.3

MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Vulnerability description

Inconsistent interpretation of HTTP requests (HTTP response smuggling) vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on the same pooled connection, enabling response-queue poisoning against subsequent requests that share the connection.

The Mint.HTTP1.decode_body/5 function in lib/mint/http1.ex parses the chunk-size line of a Transfer-Encoding: chunked response with Integer.parse(data, 16). RFC 7230 defines chunk-size = 1*HEXDIG and forbids any sign prefix, but Integer.parse/2 accepts an optional leading + or -. A chunk-size line of +5 is accepted as a five-byte chunk; lines of +0 and -0 are accepted as the terminating zero-length chunk and end the message body early.

An RFC-strict intermediary in the response path rejects these forms, so the intermediary and the Mint client disagree on where one response ends and the next begins. On a pooled keep-alive connection, an attacker-influenced origin can inject bytes that the client attributes to the next legitimate response on the same connection, poisoning the response queue and corrupting the responses returned to unrelated in-flight requests.

This issue affects mint: from 0.1.0 before 1.9.3.

Affected

pkg:hex/mint

Module Source File Routine
Mint.HTTP1 lib/mint/http1.ex Mint.HTTP1.decode_body/5
Status Type Version Changes / Fixed in
affected semver ⓘ 0.1.0 < 1.9.3

pkg:github/elixir-mint/mint

Module Source File Routine
Mint.HTTP1 lib/mint/http1.ex Mint.HTTP1.decode_body/5
Status Type Version Changes / Fixed in
affected git ⓘ 60089586ec < fc7d16538d

Configurations

Exploitation requires a deployment topology in which an RFC-strict HTTP/1 intermediary (proxy, load balancer, or WAF) sits between the Mint client and the attacker-influenced origin, and HTTP/1 connections between the client and the intermediary are reused across requests (keep-alive with connection pooling). Mint clients that talk directly to an origin without an intermediary, or that do not reuse connections, are not exploitable for response-queue poisoning even if the vulnerable parsing behavior is present.

References

Credits

  • Finder: Thepigtails
  • Remediation developer: Andrea Leopardi
  • Remediation reviewer: Eric Meadows-Jönsson
  • Analyst: Jonatan Männchen / EEF

CVE record as JSON:  GET /cves/CVE-2026-59249.json
OSV record as JSON:  GET /osv/EEF-CVE-2026-59249.json