CVE-2026-49753: Elixir Mint HTTP response smuggling via lenient Content-Length parsing

Executive brief

Mint, a popular HTTP client for the Elixir programming language, contains a flaw in how it handles web server responses. It incorrectly accepts certain non-standard characters in the 'Content-Length' header, which can lead to 'response smuggling.' This could allow a malicious server or intermediary to interfere with web traffic, potentially causing data from one user's request to leak into another user's session.

Technical details

The vulnerability exists in 'Elixir.Mint.HTTP1.Parse':content_length_header/1 due to the use of Integer.parse/1, which permits an optional '+' sign prefix forbidden by RFC 7230. This creates a parser differential when Mint is deployed behind strict fronting proxies or load balancers that either reject or reframe such headers. An attacker (typically a compromised or malicious upstream server) can exploit this desynchronization to perform response smuggling. When connections are pooled or shared across trust boundaries, this can result in cross-request data leaks or response stream corruption. The issue is fixed in version 1.9.0.

Affected products

• elixir-mint mint < 1.9.0

Timeline

• 2026-06-02: disclosed
• 2026-07-09: advisory: GitHub Advisory published
• 1.9.0: patched

References

• https://api.github.com/users/PJUllrich
• https://github.com/PJUllrich
• https://api.github.com/users/PJUllrich/gists%7B/gist_id%7D
• https://api.github.com/users/PJUllrich/repos
• https://avatars.githubusercontent.com/u/10426523?v=4
• https://api.github.com/users/PJUllrich/events%7B/privacy%7D