CVE-2026-59249: Elixir Mint HTTP Smuggling Vulnerability

CVE-2026-59249 Overview

CVE-2026-59249 is an HTTP response smuggling vulnerability in the elixir-mint mint HTTP client library. The flaw exists in the chunked transfer-encoding parser, which accepts non-RFC-compliant chunk-size values with leading + or - sign prefixes. An RFC-strict intermediary rejects these forms, so the intermediary and the Mint client disagree on response boundaries. On pooled keep-alive connections, an attacker-influenced origin can inject bytes that Mint attributes to the next legitimate response, poisoning the response queue for unrelated in-flight requests. The vulnerability affects mint versions from 0.1.0 before 1.9.3 and is tracked as [CWE-444].

Critical Impact
A malicious HTTP/1 server can desynchronize a strict intermediary and the Mint client on the same pooled connection, corrupting responses returned to unrelated requests sharing that connection.

Affected Products

elixir-mint mint versions 0.1.0 through 1.9.2
Elixir applications using pooled HTTP/1 connections via Mint (including Finch and dependent HTTP clients)
Any Mint client fronted by an RFC-7230-strict HTTP intermediary

Discovery Timeline

2026-07-16 - CVE-2026-59249 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-59249

Vulnerability Analysis

The vulnerability resides in Mint.HTTP1.decode_body/5 inside lib/mint/http1.ex. The function parses the chunk-size line of a Transfer-Encoding: chunked response using Integer.parse(data, 16). RFC 7230 defines chunk-size = 1*HEXDIG and forbids any sign prefix, but Elixir's Integer.parse/2 accepts an optional leading + or -.

As a result, a chunk-size line of +5 is accepted as a five-byte chunk, and lines of +0 or -0 are accepted as the terminating zero-length chunk. This causes Mint to terminate the message body earlier than an RFC-strict intermediary would. The two parties disagree on where one response ends and the next begins, enabling response-queue poisoning on pooled keep-alive connections.

Root Cause

The root cause is delegation of protocol-level parsing to a general-purpose numeric parser. Integer.parse/2 treats + and - as valid prefixes, violating the strict grammar defined in RFC 7230. Mint did not enforce the 1*HEXDIG restriction before invoking the numeric conversion.

Attack Vector

An attacker who controls or influences an origin server serves crafted chunked responses containing sign-prefixed chunk-size lines. When Mint sits behind an RFC-strict intermediary and uses connection pooling, the client and intermediary disagree on response boundaries. Trailing bytes from the malicious response are consumed by Mint as the start of a subsequent, unrelated response on the same pooled connection.

text

// Security patch in lib/mint/http1.ex
// Source: https://github.com/elixir-mint/mint/commit/fc7d16538db7e40b56ed489f08683225cb0197fa
   defp decode_body({:chunked, nil}, conn, data, request_ref, responses) do
-    case Integer.parse(data, 16) do
-      {_size, ""} ->
+    case Parse.chunk_size(data) do
+      :more ->
         conn = put_in(conn.buffer, data)
         conn = put_in(conn.request.body, {:chunked, nil})
         {:ok, conn, responses}

-      {0, rest} ->
+      {:ok, 0, rest} ->
         {conn, responses} = collapse_body_buffer(conn, responses)
         decode_body({:chunked, :metadata, :trailer}, conn, rest, request_ref, responses)

-      {size, rest} when size > 0 ->
+      {:ok, size, rest} ->
         decode_body({:chunked, :metadata, size}, conn, rest, request_ref, responses)

-      _other ->
+      :error ->
         {:error, conn, wrap_error(:invalid_chunk_size), responses}
     end
   end

The patch replaces Integer.parse/2 with a dedicated Parse.chunk_size/1 function that enforces 1*HEXDIG via a new is_hex_digit macro, rejecting any input containing a sign prefix.

Detection Methods for CVE-2026-59249

Indicators of Compromise

Chunked HTTP/1 responses containing chunk-size lines beginning with + or - (for example +5, +0, -0)
Intermediary access logs showing 400 Bad Request or protocol-error rejections for chunked responses while backend clients continue processing
Cross-request response corruption reports from applications using Mint-based HTTP pools (Finch, Req)
Unexpected response bodies or headers appearing on requests to unrelated origins sharing a pooled connection

Detection Strategies

Inspect outbound HTTP/1 chunked responses at the intermediary for chunk-size tokens that do not match the strict 1*HEXDIG grammar
Enumerate the dependency tree of Elixir/Erlang applications for mint versions below 1.9.3 using mix deps or SBOM tooling
Correlate application-layer response anomalies with pooled keep-alive connection identifiers to identify smuggling patterns

Monitoring Recommendations

Log and alert on any HTTP/1 chunked framing errors emitted by front-line proxies such as nginx, HAProxy, or Envoy
Monitor Mint or Finch telemetry events for :invalid_chunk_size errors after upgrading to the patched version
Track HTTP client library versions in production inventories and flag any workload still pinned below mint 1.9.3

How to Mitigate CVE-2026-59249

Immediate Actions Required

Upgrade mint to version 1.9.3 or later in all Elixir/Erlang applications and rebuild release artifacts
Update transitive consumers such as finch and req and redeploy any service that pools HTTP/1 connections through Mint
Audit HTTP paths where Mint sits behind an RFC-strict intermediary and evaluate whether connection pooling can be temporarily disabled

Patch Information

The fix landed in commit fc7d16538db7e40b56ed489f08683225cb0197fa and is included in mint 1.9.3. It introduces a strict Parse.chunk_size/1 parser in lib/mint/http1/parse.ex backed by a new is_hex_digit macro that rejects sign prefixes. Full details are available in the GitHub Security Advisory GHSA-x3x7-96vm-6h2w and the CNA CVE-2026-59249 Advisory.

Workarounds

Disable HTTP/1 connection pooling in Mint-based clients so responses cannot be attributed to subsequent requests
Configure upstream proxies to strip or reject Transfer-Encoding: chunked responses containing non-hex characters in chunk-size lines
Prefer HTTP/2 endpoints where available, since the affected parser only handles HTTP/1 chunked framing

bash

# Update mint in mix.exs to a patched version
# {:mint, "~> 1.9.3"}
mix deps.update mint
mix deps.get
mix deps.compile mint