EEF-CVE-2026-48861 CVE-2026-48861 GHSA-2pg6-44cx-c49v
CRLF injection in HTTP/1 request line via unvalidated method in Mint
- Severity
- 0.0 / 10
- Low · CVSS 4.0
- Exploit chance (EPSS)
- 0.17%
- Chance of exploitation in the next 30 days. Higher than 5.93% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')
- Fix
1.9.0- Upgrade mint to this version or later
Description
Summary
Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in elixir-mint Mint allows HTTP Request Splitting and HTTP Request Smuggling.
In lib/mint/http1/request.ex, the encode_request_line/2 function splices the caller-supplied method and target arguments directly into the HTTP/1 request line without any character validation: [method, ?\s, target, " HTTP/1.1\r\n"]. An application that forwards attacker-controlled input as the HTTP method or target to Mint.HTTP.request/5 is therefore exposed to request-line CRLF injection: the attacker can terminate the request line early, inject arbitrary headers, and smuggle an entirely separate pipelined HTTP request onto the same TCP connection.
Mint 1.7.0 introduced validate_request_target/2, which rejects CRLF and other control characters in the target by default and closes the path/query vector unless the caller opts out via skip_target_validation: true. The method field remains unvalidated, so the method-based injection is exploitable under the default Mint configuration on all versions.
This issue affects mint: from 0.1.0 before 1.9.0.
Affected versions
Hex
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
mint Hex → 1.9.0
- mix
{:mint, "~> 1.9.0"} # then: mix deps.update mint
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
- Attack vector
- Local
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- Low
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- Low
- Availability (subsequent systems)
- None
Weakness
CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
How to prevent it
- Implementation: Avoid using CRLF as a special sequence.
- Implementation: Appropriately filter or quote CRLF sequences in user-controlled input.
References
Advisories
Fixes and patches
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| EEF-CVE-2026-94194 Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediaries | Not rated yet | Also affects mint |
| EEF-CVE-2026-92103 Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size | Not rated yet | Also affects mint |
| EEF-CVE-2026-91043 HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memory | Not rated yet | Also affects mint |
| EEF-CVE-2026-82672 Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connections | Not rated yet | Also affects mint |
| EEF-CVE-2026-82728 Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS | Not rated yet | Also affects mint |
| EEF-CVE-2026-82729 Quadratic chunk-size parsing in Mint.HTTP1.Parse allows CPU-exhaustion DoS | Not rated yet | Also affects mint |
| EEF-CVE-2026-59249 Sign-tolerant HTTP/1 chunk-size parser in Mint enables response smuggling against strict intermediaries on pooled connections | Not rated yet | Also affects mint |
| EEF-CVE-2026-59246 Zero-length HTTP/2 CONTINUATION frames bypass Mint's header-block byte-size cap and exhaust client memory | Not rated yet | Also affects mint |
Credits: Eric Meadows-Jönsson, Jonatan Männchen / EEF, Peter Ullrich
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor