CVE-2026-82672: Elixir Mint HTTP Smuggling Vulnerability

CVE-2026-82672 Overview

CVE-2026-82672 is an HTTP Request/Response Smuggling vulnerability [CWE-444] in the elixir-mint mint HTTP client library. The flaw allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client sharing a pooled connection. Attackers exploit lenient chunked transfer-encoding parsing to poison the response queue for subsequent requests on the same connection. The vulnerability affects mint versions from 0.1.0 before 1.10.1 and is fixed in 1.10.1.

Critical Impact
A malicious upstream server can desynchronize chunk boundaries between a Mint client and an RFC-strict intermediary, poisoning responses delivered to other requests sharing a pooled HTTP/1 connection.

Affected Products

elixir-mint mint >= 0.1.0, < 1.10.1
Elixir applications using Mint for pooled HTTP/1 client connections
Downstream libraries such as Finch and Req that depend on vulnerable Mint versions

Discovery Timeline

2026-09-19 - CVE-2026-82672 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-82672

Vulnerability Analysis

The defect lives in Mint's HTTP/1 chunked transfer-encoding parser. Mint.HTTP1.Parse.chunk_size/1 in lib/mint/http1/parse.ex stops at the first non-hexadecimal byte of a chunk-size line and returns the unparsed remainder. Mint.HTTP1.decode_body/5 in lib/mint/http1.ex then invokes Parse.ignore_until_crlf/1, discarding every byte through the terminating CRLF.

The accepted grammar becomes a run of hex digits followed by arbitrary bytes. RFC 9112 permits only a ;-introduced chunk extension after the chunk size. Lines such as 5ZZZZZ and 5 9 are accepted by Mint as chunk size 5, and 0ZZZZ is accepted as the terminating zero-length chunk. An intermediary enforcing RFC 9112 rejects those lines, so the two peers disagree on where each response body ends.

Root Cause

The root cause is inconsistent HTTP grammar enforcement between Mint and RFC-compliant intermediaries. Mint's parser treats anything up to CRLF as valid metadata, while the RFC only permits chunk extensions introduced by a semicolon. This parsing divergence produces different views of response framing on the same byte stream.

Attack Vector

A malicious HTTP/1 origin server crafts chunked responses containing non-conforming characters between the chunk size and the CRLF. When Mint pools HTTP/1 connections through a strict forward or reverse proxy, the server can force the proxy to interpret one response boundary while Mint interprets another. Bytes intended for one request are then delivered as the response body or headers of a later request that reuses the pooled connection, enabling response-queue poisoning against callers who share the socket.

text

// Patch: introduce strict CRLF handling helpers in the parser
// Source: https://github.com/elixir-mint/mint/commit/60089586ec7adc9fddb09f69a2f5919ba9ac7f33

def strip_crlf(<<"\r\n", rest::binary>>), do: {:ok, rest}
def strip_crlf(binary) when byte_size(binary) < 2, do: :more
def strip_crlf(_other), do: :error

def ignore_until_crlf(<<>>), do: :more
def ignore_until_crlf(<<"\r\n", rest::binary>>), do: {:ok, rest}
def ignore_until_crlf(<<_char, rest::binary>>), do: ignore_until_crlf(rest)

elixir

# Patch: replace permissive ignore_until_crlf with chunk_extensions validation
# Source: https://github.com/elixir-mint/mint/commit/c82377838dc6e275ef40bafa664fbcdf50270c60

defp decode_body({:chunked, :metadata, size}, conn, data, request_ref, responses) do
  case Parse.chunk_extensions(data) do
    {:ok, rest} ->
      decode_body({:chunked, size}, conn, rest, request_ref, responses)

    :more ->
      buffer_response_line(conn, data, responses, {:chunked, :metadata, size})

    :error ->
      {:error, conn, wrap_error(:invalid_chunk_size), responses}
  end
end

Detection Methods for CVE-2026-82672

Indicators of Compromise

Chunk-size lines in HTTP/1 traffic containing bytes other than hex digits, ;, whitespace, or CRLF before the terminating CRLF.
Intermediary error logs reporting invalid chunked encoding or malformed chunk size immediately followed by anomalous downstream responses.
Mismatched Content-Length versus actual body bytes observed by clients sharing a pooled connection to the same origin.
Applications receiving responses whose headers or status do not correspond to the request they issued on a pooled Mint connection.

Detection Strategies

Inventory Elixir dependencies for mint versions below 1.10.1, including transitive use via Finch, Req, Tesla, and Swoosh.
Inspect HTTP/1 proxy access and error logs for chunk parsing violations correlated with backend responses from Mint-based clients.
Compare framing decisions between the intermediary and the client by capturing pcaps on both segments of the connection.
Assert that outbound HTTP client responses match expected request identifiers when connection pooling is enabled.

Monitoring Recommendations

Alert on proxy log entries indicating invalid chunk encoding from upstream origins that clients continue to reuse.
Track dependency drift with Software Composition Analysis to catch regressions to pre-1.10.1 Mint releases.
Monitor error telemetry for the new :invalid_chunk_size error returned by patched Mint versions to identify attempted exploitation after upgrading.

How to Mitigate CVE-2026-82672

Immediate Actions Required

Upgrade mint to version 1.10.1 or later across all Elixir services and rebuild release artifacts.
Update downstream HTTP client libraries such as Finch and Req to versions that pin Mint >= 1.10.1.
Audit outbound HTTP destinations and remove pooled connections to untrusted or third-party origins where feasible.
Restart long-running BEAM nodes after upgrade so existing pooled connections are torn down and re-established with the patched parser.

Patch Information

The fix is delivered in Mint 1.10.1. The parser now validates chunk metadata via Parse.chunk_extensions/1 and returns :invalid_chunk_size when it encounters bytes that violate RFC 9112. Details are published in the GitHub Security Advisory GHSA-rj5m-69wp-cxq9, the EEF CNA advisory, and the OSV vulnerability report. Reference commits are available at commit 60089586 and commit c8237783.

Workarounds

Disable HTTP/1 connection pooling for outbound clients that traverse strict intermediaries until the upgrade is deployed.
Force HTTP/2 to origins that support it, since the vulnerability is specific to HTTP/1 chunked framing.
Restrict outbound HTTP/1 traffic to trusted origins under your control to reduce the risk of a malicious server crafting the smuggling payload.

bash

# Update Mint in mix.exs and refresh the lockfile
# mix.exs
# defp deps do
#   [
#     {:mint, "~> 1.10.1"}
#   ]
# end

mix deps.update mint
mix deps.get
mix deps.compile --force

# Verify the resolved version
mix deps | grep -A1 " mint "