Is CVE-2026-94194 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-94194 being exploited in the wild.

How severe is CVE-2026-94194?

Informational severity, published 28 September 2026.

Which products and versions are affected?

Elixir-Mint Mint 0.1.0 before 1.11.0.

Is there a fix for CVE-2026-94194?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-94194 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-94194?

Check whether you run Elixir-Mint Mint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-94194: Mint HTTP request/response smuggling in transfer encoding parsing

CVE-2026-94194 · Severity: info · Published 2026-09-28

Mint is an Elixir HTTP client library used to make requests to web services. A malicious or compromised HTTP server can send specially crafted responses that cause Mint to misinterpret message boundaries on connection pools, leading it to associate responses with incorrect requests. An attacker could use this to poison responses seen by legitimate application code, potentially causing data leakage, request injection, or application logic bypass.

Technologies: Elixir-Mint Mint. Vendors: Elixir-Mint.

Quick answers

Is CVE-2026-94194 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-94194 being exploited in the wild.
How severe is CVE-2026-94194?: Informational severity, published 28 September 2026.
Which products and versions are affected?: Elixir-Mint Mint 0.1.0 before 1.11.0.
Is there a fix for CVE-2026-94194?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-94194 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-94194?: Check whether you run Elixir-Mint Mint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in message_body/1 in lib/mint/http1.ex, which applies chunked transfer encoding when chunked appears first in the Transfer-Encoding header, contrary to RFC 9112 section 6.3 which requires it be final. Additionally, Mint incorrectly keeps connections open after HTTP/1.0 responses with Transfer-Encoding and Connection: keep-alive, violating RFC 9112 section 6.1. Both cases allow an attacker-controlled server to desynchronize the client and intermediaries on pooled connections, causing response poisoning for subsequent requests sharing the same connection.

Affected products

elixir-mint mint 0.1.0 before 1.11.0

Timeline

2026-09-28: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.