CVE-2026-82672: Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connections
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on a pooled connection, enabling response-queue poisoning against subsequent requests that share the connection.
Mint.HTTP1.Parse.chunksize/1 in lib/mint/http1/parse.ex stops at the first non-hexadecimal byte of a chunked response's chunk-size line and returns the remainder unexamined. Mint.HTTP1.decodebody/5 in lib/mint/http1.ex then discards every byte up to the CRLF with Parse.ignoreuntilcrlf/1, so the accepted grammar is a run of hex digits followed by arbitrary bytes, where RFC 9112 permits only a ;-introduced chunk extension. Lines such as 5ZZZZZ and 5 9 are accepted as chunk size 5, and 0ZZZZ is accepted as the terminating chunk that ends the message body. An RFC-strict intermediary rejects such a line while Mint accepts it, so the two disagree on chunk boundaries and on where the response ends.
This issue affects mint: from 0.1.0 before 1.10.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
elixir-mint mintto a version that resolves this vulnerability.Fixed in 1.10.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using mint versions from 0.1.0 before 1.10.1 are affected when they use the HTTP/1 client and reuse pooled connections. Exploitation also depends on a malicious HTTP/1 server response being interpreted differently by Mint and an RFC-strict intermediary.
What does an attacker need to send?
The attacker needs to control an HTTP/1 server response and provide chunked transfer encoding with a chunk-size line that starts with hexadecimal digits but has an invalid trailing value before the CRLF. Examples given include "5ZZZZZ", "5 9", and "0ZZZZ".
Why are pooled connections relevant?
The desynchronization can poison the response queue for later requests that share the same connection. A malicious response can therefore affect how subsequent responses on that pooled connection are associated with requests.
What version resolves the issue?
Upgrade Mint to version 1.10.1 or later. Versions before 1.10.1, starting at 0.1.0, are listed as affected.