elixir-mint 0.1.0/1.10.0 Chunked Parser lib/mint/http1/parse.ex Mint.HTTP/1.Parse.chunk_size expected behavior violation

Summaryinfo

A vulnerability was found in elixir-mint mint 0.1.0/1.10.0 and classified as critical. The impacted element is the function Mint.HTTP1.Parse.chunk_size of the file lib/mint/http1/parse.ex of the component Chunked Parser. The manipulation results in expected behavior violation. This vulnerability is cataloged as CVE-2026-82672. The attack may be launched remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in elixir-mint mint 0.1.0/1.10.0. Affected is the function Mint.HTTP1.Parse.chunk_size of the file lib/mint/http1/parse.ex of the component Chunked Parser. The manipulation with an unknown input leads to a expected behavior violation vulnerability. CWE is classifying the issue as CWE-440. A feature, API, or function does not perform according to its specification. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on a pooled connection, enabling response-queue poisoning against subsequent requests that share the connection. Mint.HTTP1.Parse.chunk_size/1 in lib/mint/http1/parse.ex stops at the first non-hexadecimal byte of a chunked response's chunk-size line and returns the remainder unexamined. Mint.HTTP1.decode_body/5 in lib/mint/http1.ex then discards every byte up to the CRLF with Parse.ignore_until_crlf/1, so the accepted grammar is a run of hex digits followed by arbitrary bytes, where RFC 9112 permits only a ;-introduced chunk extension. Lines such as 5ZZZZZ and 5 9 are accepted as chunk size 5, and 0ZZZZ is accepted as the terminating chunk that ends the message body. An RFC-strict intermediary rejects such a line while Mint accepts it, so the two disagree on chunk boundaries and on where the response ends. This issue affects mint: from 0.1.0 before 1.10.1.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-82672 since 09/17/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available.

Upgrading to version 1.10.1 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• elixir-mint

Name

• mint

Version

• 0.1.0
• 1.10.0

Website

• Product: https://github.com/elixir-mint/mint/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion