Quick answers
- Is CVE-2026-49753 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-49753 being exploited in the wild.
- How severe is CVE-2026-49753?
- Medium severity, with a CVSS score of 6.3, published 2 June 2026.
- Which products and versions are affected?
- Elixir-Mint Mint < 1.9.0, >= 0.1.0, < 1.9.0.
- Is there a fix for CVE-2026-49753?
- A patch was published on 1.9.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-49753 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-49753?
- Check whether you run Elixir-Mint Mint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in 'Elixir.Mint.HTTP1.Parse':content_length_header/1 due to the use of Integer.parse/1, which permits an optional '+' sign prefix forbidden by RFC 7230. This creates a parser differential when Mint is deployed behind strict fronting proxies or load balancers that either reject or reframe such headers. An attacker (typically a compromised or malicious upstream server) can exploit this desynchronization to perform response smuggling. When connections are pooled or shared across trust boundaries, this can result in cross-request data leaks or response stream corruption. The issue is fixed in version 1.9.0.
Affected products
- elixir-mint mint < 1.9.0
Identifiers
- CVE-2026-49753
- GHSA-mjqx-c6f6-7rc2
Timeline
- 2026-06-02: disclosed
- 2026-07-09: advisory: GitHub Advisory published
- 1.9.0: patched