elixir-mint vulnerabilities

Newest CVEs

• CVE-2026-94194

  Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediaries

  elixir-mint · mint

  Medium6.3
• CVE-2026-92103

  Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size

  elixir-mint · mint

  Medium6.3
• CVE-2026-91043

  HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memory

  elixir-mint · mint

  High8.2
• CVE-2026-82672

  Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connections

  elixir-mint · mint

  Medium6.3
• CVE-2026-82728

  Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS

  elixir-mint · mint

  High8.2
• CVE-2026-82729

  Quadratic chunk-size parsing in Mint.HTTP1.Parse allows CPU-exhaustion DoS

  elixir-mint · mint

  Medium6.3
• CVE-2026-59249

  Sign-tolerant HTTP/1 chunk-size parser in Mint enables response smuggling against strict intermediaries on pooled connections

  elixir-mint · mint

  Medium6.3
• CVE-2026-59246

  Zero-length HTTP/2 CONTINUATION frames bypass Mint's header-block byte-size cap and exhaust client memory

  elixir-mint · mint

  Medium6.3
• CVE-2026-58229

  Unbounded HTTP/1 response-header and chunked-trailer accumulation in Mint causes memory-exhaustion DoS

  elixir-mint · mint

  High8.2
• CVE-2026-56810

  mint buffers an entire chunked response chunk in memory in Mint.HTTP1.decode_body/5

  elixir-mint · mint

  High8.7