Current section
14 Advisories
Jump to
Current section
14 Advisories
Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediaries
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-94194.html
- https://github.com/elixir-mint/mint/commit/2ec8b696b5475ecbdaa87c0098957bca339e17c0
- https://github.com/elixir-mint/mint/commit/60089586ec7adc9fddb09f69a2f5919ba9ac7f33
- https://github.com/elixir-mint/mint/commit/8d1bbcfa566a8c1dc23d33f40d550c28250ac7b9
- https://github.com/elixir-mint/mint/security/advisories/GHSA-gvrc-75rc-7gj9
- https://hex.pm/packages/mint
Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-92103.html
- https://github.com/elixir-mint/mint/commit/20252ca85065f4d1092aed9ee4ed21841a507dfe
- https://github.com/elixir-mint/mint/commit/44d7ce4755d0444ee415cbcca7ce4942382da4dd
- https://github.com/elixir-mint/mint/commit/596ca4304504be68939c4929e0831557097962b8
- https://github.com/elixir-mint/mint/security/advisories/GHSA-q95c-ccq6-j5j6
- https://hex.pm/packages/mint
HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memory
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-91043.html
- https://github.com/elixir-mint/mint/commit/65a0d61c9eab6b0dedac809de7212515bf506250
- https://github.com/elixir-mint/mint/commit/8e0e04680476f90f9f68db4dfeabcbe66dabfc4d
- https://github.com/elixir-mint/mint/commit/c7895cb022196c77ec35570c8e873a84393ff4b8
- https://github.com/elixir-mint/mint/security/advisories/GHSA-9x8p-qrf4-jq7g
- https://hex.pm/packages/mint
Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connections
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-82672.html
- https://github.com/elixir-mint/mint/commit/60089586ec7adc9fddb09f69a2f5919ba9ac7f33
- https://github.com/elixir-mint/mint/commit/c82377838dc6e275ef40bafa664fbcdf50270c60
- https://github.com/elixir-mint/mint/security/advisories/GHSA-rj5m-69wp-cxq9
- https://hex.pm/packages/mint
Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS
Affected Versions
Quadratic chunk-size parsing in Mint.HTTP1.Parse allows CPU-exhaustion DoS
Affected Versions
Sign-tolerant HTTP/1 chunk-size parser in Mint enables response smuggling against strict intermediaries on pooled connections
Affected Versions
Zero-length HTTP/2 CONTINUATION frames bypass Mint's header-block byte-size cap and exhaust client memory
Affected Versions
Unbounded HTTP/1 response-header and chunked-trailer accumulation in Mint causes memory-exhaustion DoS
Affected Versions
Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrency
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-48862.html
- https://github.com/elixir-mint/mint
- https://github.com/elixir-mint/mint/commit/70b97b6a5209fb288b0e04d8e657dda26c59de67
- https://github.com/elixir-mint/mint/security/advisories/GHSA-g586-ccqf-7x4r
- https://hex.pm/packages/mint
- https://nvd.nist.gov/vuln/detail/CVE-2026-48862
- https://osv.dev/vulnerability/EEF-CVE-2026-48862
HTTP/2 CONTINUATION flood in Mint client via unbounded header-block accumulation
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-49754.html
- https://github.com/elixir-mint/mint
- https://github.com/elixir-mint/mint/commit/b662d127d3028b5426c88d4c9cc7fe430491a10b
- https://github.com/elixir-mint/mint/security/advisories/GHSA-2p26-p43x-fhp8
- https://hex.pm/packages/mint
- https://nvd.nist.gov/vuln/detail/CVE-2026-49754
- https://osv.dev/vulnerability/EEF-CVE-2026-49754
HTTP response smuggling in Mint HTTP/1 client via lenient Content-Length parsing
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-49753.html
- https://github.com/elixir-mint/mint
- https://github.com/elixir-mint/mint/commit/47e48027480228e4e32a0b4df39db497b4804921
- https://github.com/elixir-mint/mint/security/advisories/GHSA-mjqx-c6f6-7rc2
- https://hex.pm/packages/mint
- https://nvd.nist.gov/vuln/detail/CVE-2026-49753
- https://osv.dev/vulnerability/EEF-CVE-2026-49753
CRLF injection in HTTP/1 request line via unvalidated method in Mint
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-48861.html
- https://github.com/elixir-mint/mint
- https://github.com/elixir-mint/mint/commit/fad091454cbb7449b19edb8e1fee12ca7cf28c3a
- https://github.com/elixir-mint/mint/security/advisories/GHSA-2pg6-44cx-c49v
- https://hex.pm/packages/mint
- https://nvd.nist.gov/vuln/detail/CVE-2026-48861
- https://osv.dev/vulnerability/EEF-CVE-2026-48861
mint buffers an entire chunked response chunk in memory in Mint.HTTP1.decode_body/5
Affected Versions
Checksum
Dependency Config
mix.exs
rebar.config
Gleam
erlang.mk
Package Details
this version
301 788
yesterday
102 699
last 7 days
565 182
all time
67 359 491
