mint (Hex)
Advisories
18
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 1.10.2 or later clears every advisory below that has a fix.
Upgrade commands
mix
{:mint, "~> 1.10.2"} # then: mix deps.update mintKnown vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| EEF-CVE-2026-94194 Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediaries |
Not rated yet EPSS 0.42% |
>= 0.1.0, < 1.10.2 | 1.10.2 |
| EEF-CVE-2026-92103 Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size |
Not rated yet EPSS 0.33% |
>= 0.1.0, < 1.10.2 | 1.10.2 |
| EEF-CVE-2026-91043 HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memory |
Not rated yet EPSS 0.42% |
>= 1.1.0, < 1.10.2 | 1.10.2 |
| EEF-CVE-2026-82672 Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connections |
Not rated yet EPSS 0.52% |
>= 0.1.0, < 1.10.1 | 1.10.1 |
| EEF-CVE-2026-82728 Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS |
Not rated yet EPSS 0.52% |
>= 0.1.0, < 1.10.0 | 1.10.0 |
| EEF-CVE-2026-82729 Quadratic chunk-size parsing in Mint.HTTP1.Parse allows CPU-exhaustion DoS |
Not rated yet EPSS 0.52% |
>= 1.9.3, < 1.10.0 | 1.10.0 |
| EEF-CVE-2026-59249 Sign-tolerant HTTP/1 chunk-size parser in Mint enables response smuggling against strict intermediaries on pooled connections |
Not rated yet EPSS 0.52% |
>= 0.1.0, < 1.9.3 | 1.9.3 |
| EEF-CVE-2026-59246 Zero-length HTTP/2 CONTINUATION frames bypass Mint's header-block byte-size cap and exhaust client memory |
Not rated yet EPSS 0.50% |
>= 0.1.0, < 1.9.2 | 1.9.2 |
| EEF-CVE-2026-58229 Unbounded HTTP/1 response-header and chunked-trailer accumulation in Mint causes memory-exhaustion DoS |
Not rated yet EPSS 0.50% |
>= 0.1.0, < 1.9.2 | 1.9.2 |
| EEF-CVE-2026-56810 mint buffers an entire chunked response chunk in memory in Mint.HTTP1.decode_body/5 |
Not rated yet EPSS 0.43% |
>= 0.5.0, < 1.9.1 | 1.9.1 |
| EEF-CVE-2026-49753 HTTP response smuggling in Mint HTTP/1 client via lenient Content-Length parsing |
Medium EPSS 0.30% |
>= 0.1.0, < 1.9.0 | 1.9.0 |
| EEF-CVE-2026-49753 HTTP response smuggling in Mint HTTP/1 client via lenient Content-Length parsing |
Medium EPSS 0.30% |
< 1.9.0 | 1.9.0 |
| EEF-CVE-2026-49754 HTTP/2 CONTINUATION flood in Mint client via unbounded header-block accumulation |
High EPSS 0.38% |
< 1.9.0 | 1.9.0 |
| EEF-CVE-2026-49754 HTTP/2 CONTINUATION flood in Mint client via unbounded header-block accumulation |
High EPSS 0.38% |
>= 0.1.0, < 1.9.0 | 1.9.0 |
| EEF-CVE-2026-48862 Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrency |
High EPSS 0.38% |
>= 0.2.0, < 1.9.0 | 1.9.0 |
| EEF-CVE-2026-48862 Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrency |
High EPSS 0.38% |
>= 0.2.0, < 1.9.0 | 1.9.0 |
| EEF-CVE-2026-48861 CRLF injection in HTTP/1 request line via unvalidated method in Mint |
Low EPSS 0.17% |
< 1.9.0 | 1.9.0 |
| EEF-CVE-2026-48861 CRLF injection in HTTP/1 request line via unvalidated method in Mint |
Low EPSS 0.17% |
>= 0.1.0, < 1.9.0 | 1.9.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor