HTTP Request/Response Smuggling Vulnerability in Mint by Elixir

CVE-2026-49753

What is CVE-2026-49753?

An inconsistency in the interpretation of HTTP requests within the Mint HTTP client allows attacker-controlled servers to manipulate response framing on shared connections. Specifically, the issue lies with how Mint's Content-Length parser handles headers containing a '+' prefix, treating them as valid lengths, contrary to the standards set by RFC 7230. This misinterpretation can lead to response smuggling, where bytes from one response are erroneously merged into another, potentially compromising the integrity of communications when connections are reused across different trust boundaries. It is critical for developers and system administrators to be aware of this vulnerability and apply patches to secure their applications.

References