Is CVE-2026-59249 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59249 being exploited in the wild.

How severe is CVE-2026-59249?

Informational severity, with a CVSS score of 6.3, published 16 July 2026.

Which products and versions are affected?

Elixir-Mint Mint >= 0.1.0, < 1.9.3.

Is there a fix for CVE-2026-59249?

A patch was published on 2026-07-16: Fixed in version 1.9.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59249 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-59249?

Check whether you run Elixir-Mint Mint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59249: Elixir Mint HTTP response smuggling in HTTP/1 chunk-size parsing

Q: Is there a fix for CVE-2026-59249?

A patch was published on 2026-07-16: Fixed in version 1.9.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-59249 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-59249?

Check whether you run Elixir-Mint Mint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59249 · Severity: info · CVSS 6.3 · Published 2026-07-16

Mint is a low-level HTTP client for the Elixir programming language. A vulnerability in how it handles certain web traffic allows a malicious server to 'smuggle' data into a shared connection. This could lead to a situation where one user receives a response intended for another, potentially exposing sensitive data or causing the application to behave incorrectly.

Technologies: Elixir-Mint Mint. Vendors: Elixir-Mint.

Quick answers

Is CVE-2026-59249 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59249 being exploited in the wild.
How severe is CVE-2026-59249?: Informational severity, with a CVSS score of 6.3, published 16 July 2026.
Which products and versions are affected?: Elixir-Mint Mint >= 0.1.0, < 1.9.3.
Is there a fix for CVE-2026-59249?: A patch was published on 2026-07-16: Fixed in version 1.9.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59249 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-59249?: Check whether you run Elixir-Mint Mint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Mint.HTTP1.decode_body/5 function in lib/mint/http1.ex uses Elixir's Integer.parse(data, 16) to process chunk-size lines. While RFC 7230 forbids sign prefixes in chunk sizes, Integer.parse/2 accepts leading '+' or '-' characters. This discrepancy allows a malicious origin server to desynchronize the Mint client from an RFC-strict intermediary (like a proxy or WAF) on a pooled keep-alive connection. An attacker can use this to poison the response queue, causing the client to attribute injected bytes to subsequent, unrelated requests sharing the same connection. The issue is fixed in version 1.9.3 by implementing a strict HEXDIG-only parser.

Affected products

elixir-mint mint >= 0.1.0, < 1.9.3

Timeline

2026-07-16: disclosed
2026-07-16: advisory
2026-07-16: patched: Fixed in version 1.9.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.