HTTP Request Smuggling Vulnerability in Elixir Mint

CVE-2026-94194

What is CVE-2026-94194?

An inconsistency in HTTP request handling within Elixir Mint can lead to a serious security issue where a malicious HTTP/1 server can disrupt communication between an intermediary and the Mint client. This flaw allows the potential poisoning of responses to future requests sharing the same connection. Due to its improper interpretation of Transfer-Encoding headers, the Mint library miscalculates the end of HTTP responses, which can result in data leaks or manipulated responses affecting application integrity. This vulnerability impacts versions from 0.1.0 up to but not including 1.11.0, requiring immediate attention to ensure secure communication.

References