Executive brief
Mint is an HTTP client library for Elixir applications. A malicious HTTP server can exploit inconsistent parsing of chunked responses to desynchronize with intermediaries (proxies, gateways), causing the Mint client to process attacker-controlled data intended for a different request on a reused connection. This enables response poisoning and potential session hijacking in applications that reuse connections.
Technical details
The vulnerability lies in Mint.HTTP1.Parse.chunk_size/1 which accepts non-compliant chunk-size lines (e.g., "5ZZZZZ" or "0ZZZZ") by stopping at the first non-hex byte and ignoring the rest until CRLF, rather than validating RFC 9112 chunk extension syntax. An RFC-compliant intermediary rejects such malformed lines while Mint accepts them, causing disagreement on message boundaries. Attack requires a malicious or compromised server and connection pooling, allowing response queue poisoning on subsequent pooled requests.
Affected products
- elixir-mint Mint 0.1.0 before 1.10.1
Timeline
- 2026-09-19: disclosed