CRLF Injection Vulnerability in Elixir Mint by Elixir

CVE-2026-48861

What is CVE-2026-48861?

The Mint library in Elixir has a vulnerability where improper handling of CRLF sequences can lead to HTTP Request Splitting and Smuggling. The encode_request_line method directly integrates user-supplied HTTP method and target without sufficient validation, enabling attackers to inject arbitrary headers and create separate pipelined HTTP requests over the same TCP connection. While version 1.7.0 aimed to enhance validation, the method field remains unverified, exposing all versions to potential exploitation when attacker-controlled input is used.

References