CVE-2026-48861: Elixir Mint CRLF Injection Vulnerability

CVE-2026-48861 Overview

CVE-2026-48861 is a Carriage Return Line Feed (CRLF) injection vulnerability in the elixir-mint Mint HTTP client library [CWE-93]. The flaw resides in the encode_request_line/2 function inside lib/mint/http1/request.ex, which concatenates caller-supplied method and target values directly into the HTTP/1.1 request line without validating control characters. Applications that forward attacker-controlled input as the HTTP method or target to Mint.HTTP.request/5 are exposed to request-line CRLF injection, HTTP Request Splitting, and HTTP Request Smuggling. The issue affects mint from 0.1.0 before 1.9.0.

Critical Impact
Attackers can terminate the request line early, inject arbitrary headers, and smuggle a separate pipelined HTTP request onto the same TCP connection.

Affected Products

elixir-mint Mint versions 0.1.0 through 1.6.x (method and target injection)
elixir-mint Mint versions 1.7.0 through 1.8.x (method injection remains exploitable by default)
Any Elixir or Erlang application that forwards untrusted input as the HTTP method or target argument to Mint.HTTP.request/5

Discovery Timeline

2026-06-02 - CVE CVE-2026-48861 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-48861

Vulnerability Analysis

Mint is a low-level HTTP client for Elixir and Erlang. The encode_request_line/2 function in lib/mint/http1/request.ex constructs the HTTP/1.1 request line using the iolist pattern [method, ?\s, target, " HTTP/1.1\r\n"]. Neither the method nor the target value is filtered for \r or \n characters before serialization.

When a calling application accepts untrusted input and passes it through as either argument, an attacker can embed CRLF sequences inside the method or target string. The injected bytes are written verbatim to the underlying TCP socket. The server then parses the trailing bytes as additional headers, a request body, or an entirely separate pipelined request.

This primitive enables HTTP Request Splitting against the immediate upstream and HTTP Request Smuggling when intermediaries such as proxies or load balancers reuse the connection. Smuggled requests can bypass access controls, poison shared caches, or hijack responses intended for other clients.

Root Cause

The root cause is missing input validation on the request-line components. The encode_request_line/2 function trusts that callers provide structurally valid tokens and performs no neutralization of CRLF or other control characters before writing to the wire.

Attack Vector

Mint 1.7.0 introduced validate_request_target/2, which rejects CRLF and other control characters in the target argument by default. Applications can disable this protection by passing skip_target_validation: true. The method field remains unvalidated in all releases before 1.9.0, so method-based injection is exploitable under the default Mint configuration. Exploitation requires that the host application route attacker-controlled data into one of these arguments without independent sanitization.

No public proof-of-concept exploit is currently available. The vulnerability mechanism is documented in the GitHub Security Advisory GHSA-2pg6-44cx-c49v and the CNA advisory at cna.erlef.org.

Detection Methods for CVE-2026-48861

Indicators of Compromise

Outbound HTTP/1.1 requests containing raw \r\n byte sequences inside the method or target token on the request line.
HTTP responses indicating duplicate or unexpected requests on a single keep-alive connection.
Proxy or load balancer logs showing pipelined requests originating from an Elixir or Erlang application that did not intentionally pipeline traffic.

Detection Strategies

Audit application code for calls to Mint.HTTP.request/5 where the method or path parameter is derived from external input such as HTTP request fields, query strings, or message queue payloads.
Inspect dependency manifests (mix.exs, mix.lock) for mint versions earlier than 1.9.0.
Add network-layer detection for control characters in outbound request lines using TLS-terminating proxies or eBPF-based observability tools.

Monitoring Recommendations

Log and alert on outbound HTTP traffic from Elixir services that contains CR or LF bytes outside header boundaries.
Monitor reverse proxies and CDNs for request-smuggling signatures such as conflicting Content-Length and Transfer-Encoding headers immediately following a Mint-originated request.
Track upgrades of the mint dependency across the software bill of materials (SBOM) to confirm remediation coverage.

How to Mitigate CVE-2026-48861

Immediate Actions Required

Upgrade mint to version 1.9.0 or later, which validates control characters in both the method and target arguments.
Identify every call site that passes untrusted data to Mint.HTTP.request/5 and apply strict allowlist validation on method and path values before invocation.
Verify that no calling code passes skip_target_validation: true when handling untrusted input.

Patch Information

The fix is implemented in the upstream commit fad091454cbb7449b19edb8e1fee12ca7cf28c3a and released as mint1.9.0. The patch extends request-line validation to reject CRLF and other control characters in the HTTP method in addition to the previously protected target. Refer to the OSV entry EEF-CVE-2026-48861 for ecosystem package metadata.

Workarounds

Restrict the HTTP method argument to a fixed allowlist such as GET, POST, PUT, DELETE, PATCH, HEAD, and OPTIONS before passing it to Mint.
Reject any caller-supplied target that contains characters outside the unreserved URI set defined in RFC 3986, particularly \r (0x0D) and \n (0x0A).
Do not set skip_target_validation: true on any code path that handles externally influenced input.

bash

# Update mint to the patched release in mix.exs
# {:mint, "~> 1.9.0"}
mix deps.update mint
mix deps.get
mix deps.compile mint