CVE-2026-94194 in mint
Summary
by MITRE • 09/28/2026
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize an intermediary and the Mint client on a pooled connection, poisoning the responses to subsequent requests that share the connection.
message_body/1 in lib/mint/http1.ex selects chunked framing when chunked is the first coding listed in a response's Transfer-Encoding fields. RFC 9112 section 6.3 applies chunked framing only when chunked is the final coding, and otherwise reads the body until the server closes the connection. For a response such as Transfer-Encoding: chunked, gzip, an intermediary that follows the RFC treats every byte up to the close as the body, while Mint ends the body at the zero-length chunk and parses the remaining bytes as the response to the next request on the connection.
Mint also keeps the connection open after an HTTP/1.0 response, final or 1xx, that carries Transfer-Encoding and Connection: keep-alive. RFC 9112 section 6.1 requires treating the framing of such a message as faulty and closing the connection after it, so bytes after its chunked body are parsed as the response to the next request in the same way.
This issue affects mint: from 0.1.0 before 1.11.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/28/2026
The vulnerability identified involves an inconsistent interpretation of HTTP requests and responses, specifically manifesting as HTTP Request/Response Smuggling within the elixir-mint library. This flaw allows a malicious HTTP/1 server to desynchronize an intermediary proxy from the Mint client when operating over pooled connections. The core consequence is response poisoning, where subsequent legitimate requests sharing the same connection receive incorrect or manipulated responses due to the misalignment of message boundaries between the client and any intermediate network devices.
The technical root cause lies in how the library handles Transfer-Encoding headers during HTTP/1 parsing. Specifically, the function responsible for determining body framing logic incorrectly prioritizes chunked encoding when it appears as the first value in a comma-separated list within the Transfer-Encoding header field. According to RFC 9112 section 6.3, chunked transfer coding should only be applied if it is the final or last encoding listed. When an intermediary proxy adheres strictly to this standard, it interprets all bytes following the headers as part of the message body until the server closes the connection. In contrast, the vulnerable version of Mint prematurely terminates the current response at a zero-length chunk marker and begins parsing subsequent bytes as the start of the next HTTP request on that same persistent connection. This discrepancy creates a desynchronization state where the client believes one set of data constitutes the end of a message while the server or proxy considers it part of an ongoing stream, leading to severe protocol confusion.
A secondary aspect of this vulnerability involves the handling of HTTP/1.0 responses that include both Transfer-Encoding and Connection: keep-alive headers. The library incorrectly maintains these connections as open after receiving such messages. However, RFC 9112 section 6.1 explicitly mandates that any message containing a Transfer-Encoding header in an HTTP/1.0 context must be treated as malformed or faulty, requiring the connection to be closed immediately upon completion of that specific message. By failing to enforce this closure, Mint allows residual bytes from the chunked body of the previous response to bleed into the parsing logic for the next request. This further exacerbates the desynchronization issue, enabling an attacker to inject data that is interpreted as part of a subsequent transaction rather than being discarded or triggering a connection reset.
The operational impact of this vulnerability is significant in environments where HTTP/1 persistent connections are utilized through proxies. Attackers can exploit this misalignment to perform response smuggling attacks, potentially stealing sensitive information such as session cookies or authentication tokens intended for other users sharing the same upstream proxy and backend server infrastructure. It also facilitates cache poisoning if intermediaries store responses based on their own parsing logic while serving incorrect data derived from the client's desynchronized state. This undermines the integrity of web communications and can lead to unauthorized access, data leakage, or service disruption depending on how downstream applications process the poisoned response streams.
This issue affects versions of elixir-mint ranging from 0.1.0 up to but not including version 1.11.0. To mitigate this risk, organizations must upgrade to version 1.11.0 or later where these parsing inconsistencies have been corrected. Security teams should also ensure that their infrastructure monitors for anomalies in HTTP/1 traffic patterns indicative of smuggling attempts and enforce strict adherence to RFC standards regarding Transfer-Encoding header interpretation at all layers of the network stack.
From a classification perspective, this vulnerability aligns with CWE-436 which denotes Interpretation Conflict, as different entities interpret the same input data differently leading to security issues. It is also closely related to CWE-157 where there is a lack of synchronization between components regarding message boundaries. In terms of offensive security frameworks, this technique maps directly to MITRE ATT&CK Tactic TA0043 which covers Command and Control, specifically the sub-technique for HTTP Smuggling used to bypass firewalls or manipulate traffic flow undetected by standard monitoring tools that do not account for such protocol-level desynchronization.