elixir-mint prior 1.9.3 HTTP1 Chunked Transfer lib/mint/http1.ex decode_body data improper synchronization

Summaryinfo

A vulnerability classified as critical was found in elixir-mint mint prior 1.9.3. Affected by this issue is the function decode_body of the file lib/mint/http1.ex of the component HTTP1 Chunked Transfer Handler. The manipulation of the argument data results in improper synchronization. This vulnerability is reported as CVE-2026-59249. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability classified as critical has been found in elixir-mint mint prior 1.9.3. Affected is the function decode_body of the file lib/mint/http1.ex of the component HTTP1 Chunked Transfer Handler. The manipulation of the argument data with an unknown input leads to a improper synchronization vulnerability. CWE is classifying the issue as CWE-662. The product utilizes multiple threads or processes to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Inconsistent interpretation of HTTP requests (HTTP response smuggling) vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on the same pooled connection, enabling response-queue poisoning against subsequent requests that share the connection. The Mint.HTTP1.decode_body/5 function in lib/mint/http1.ex parses the chunk-size line of a Transfer-Encoding: chunked response with Integer.parse(data, 16). RFC 7230 defines chunk-size = 1*HEXDIG and forbids any sign prefix, but Integer.parse/2 accepts an optional leading + or -. A chunk-size line of +5 is accepted as a five-byte chunk; lines of +0 and -0 are accepted as the terminating zero-length chunk and end the message body early. An RFC-strict intermediary in the response path rejects these forms, so the intermediary and the Mint client disagree on where one response ends and the next begins. On a pooled keep-alive connection, an attacker-influenced origin can inject bytes that the client attributes to the next legitimate response on the same connection, poisoning the response queue and corrupting the responses returned to unrelated in-flight requests. This issue affects mint: from 0.1.0 before 1.9.3.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-59249 since 07/04/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available.

Upgrading to version 1.9.3 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• elixir-mint

Name

• mint

Version

• <1.9.3

Website

• Product: https://github.com/elixir-mint/mint/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion