Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-82672— Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connections

Quick assessment

Affected
elixir-mint mint
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是该漏洞描述的中文翻译： HTTP 请求/响应走私漏洞（HTTP Request/Response Smuggling） elixir-mint 的 库中存在一个 HTTP 请求/响应走私漏洞。攻击者可利用此漏洞，通过恶意 HTTP/1 服务器导致严格的中间代理与 Mint 客户端在连接池共享连接上出现状态不同步，从而对后续复用该连接的请求实施“响应队列投毒”（response-queue poisoning）攻击。 技术细节： 中的 函数在解析分块响应（chunked response）的 行时，遇到第一个非

CVSS 6.3 · Medium

Possible ATT&CK Techniques 1 AI

T1091 · Replication Through Removable Media

Affected Version Matrix 2

VendorProduct Version RangeStatus
elixir-mint mint 0.1.0< 1.10.1 affected
60089586ec7adc9fddb09f69a2f5919ba9ac7f33< c82377838dc6e275ef40bafa664fbcdf50270c60 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-82672

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connections
Source: CVE Program / CVE List V5
Vulnerability Description
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on a pooled connection, enabling response-queue poisoning against subsequent requests that share the connection. Mint.HTTP1.Parse.chunk_size/1 in lib/mint/http1/parse.ex stops at the first non-hexadecimal byte of a chunked response's chunk-size line and returns the remainder unexamined. Mint.HTTP1.decode_body/5 in lib/mint/http1.ex then discards every byte up to the CRLF with Parse.ignore_until_crlf/1, so the accepted grammar is a run of hex digits followed by arbitrary bytes, where RFC 9112 permits only a ;-introduced chunk extension. Lines such as 5ZZZZZ and 5 9 are accepted as chunk size 5, and 0ZZZZ is accepted as the terminating chunk that ends the message body. An RFC-strict intermediary rejects such a line while Mint accepts it, so the two disagree on chunk boundaries and on where the response ends. This issue affects mint: from 0.1.0 before 1.10.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
HTTP请求的解释不一致性(HTTP请求私运)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
elixir-mint mint 0.1.0 ~ 1.10.1 cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*
elixir-mint mint 60089586ec7adc9fddb09f69a2f5919ba9ac7f33 ~ c82377838dc6e275ef40bafa664fbcdf50270c60 cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-82672

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-82672

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-82672 (1)

Vendor Advisories for CVE-2026-82672 (2)

Vendor Pages for CVE-2026-82672 (1)

IV. Related Vulnerabilities

Same product: mint
Same vendor: elixir-mint
Same weakness: CWE-444

V. Comments for CVE-2026-82672

No comments yet

Leave a comment