TI-2026-36125 Aliases CVE-2026-48861 GHSA-2pg6-44cx-c49v

CRLF injection in HTTP/1 request line via unvalidated method in Mint

MEDIUM 44CWE-93Published 2026-06-02 · Updated 2026-06-02

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: —
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in elixir-mint Mint allows HTTP Request Splitting and HTTP Request Smuggling. In lib/mint/http1/request.ex, the encode_request_line/2 function splices the caller-supplied method and target arguments directly into the HTTP/1 request line without any character validation: [method, ?\s, target, " HTTP/1.1\r\n"]. An application that forwards attacker-controlled input as the HTTP method or target to Mint.HTTP.request/5 is therefore exposed to request-line CRLF injection: the attacker can terminate the request line early, inject arbitrary headers, and smuggle an entirely separate pipelined HTTP request onto the same TCP connection. Mint 1.7.0 introduced validate_request_target/2, which rejects CRLF and other control characters in the target by default and closes the path/query vector unless the caller opts out via skip_target_validation: true. The method field remains unvalidated, so the method-based injection is exploitable under the default Mint configuration on all versions. This issue affects mint: from 0.1.0 before 1.9.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00167 5th percentileScored 2026-11-07

Fix Fixed mint (elixir-mint): 1.9.0mint (Hex): 1.9.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
elixir-mint	mint	0.1.0 to before 1.9.0	1.9.0	Patch available	CNA
—	mint (Hex)	before 1.9.0	1.9.0	Patch available	GHSA-2pg6-44cx-c49v

mint Vendorelixir-mint Affected 0.1.0 to before 1.9.0 Fixed in 1.9.0 Patch available CNA
mint (Hex) Vendor— Affected before 1.9.0 Fixed in 1.9.0 Patch available GHSA-2pg6-44cx-c49v

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:elixir-mint:mint::::::::	—	—	—

cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Fix · CNA mint (elixir-mint) Fixed in 1.9.0
Fix · GHSA-2pg6-44cx-c49v mint (Hex) Fixed in 1.9.0 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-06-02
elixir-mint mint 1.9.0
4 records Highest priority Priority HIGH 2 HIGH, 2 MEDIUM
Other records, highest priority first
- TI-2026-36665 HTTP/2 CONTINUATION flood in Mint client via unbounded header-block accumulationPriority HIGH 75
- TI-2026-36126 Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrencyPriority HIGH 75
- TI-2026-36664 HTTP response smuggling in Mint HTTP/1 client via lenient Content-Length parsingPriority MEDIUM 61
Show all 4 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-48861
2026-10-03 Alias added: GHSA-2pg6-44cx-c49v

References

Patch 1

https://github.com/elixir-mint/mint/commit/fad091454cbb7449b19edb8e1fee12ca7cf28c3a

Advisory 2

Other 3

TI-2026-41929 Unauthenticated denial-of-service via unbounded HPACK integer decoding in hpax CVSS 4.0HIGH 8.7
TI-2026-40963 mint buffers an entire chunked response chunk in memory in Mint.HTTP1.decode_body/5 CVSS 4.0HIGH 8.7
TI-2026-36665 HTTP/2 CONTINUATION flood in Mint client via unbounded header-block accumulation CVSS 4.0HIGH 8.2
TI-2026-36126 Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrency CVSS 4.0HIGH 8.2
TI-2026-57046 Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS CVSS 4.0HIGH 8.2
TI-2026-41932 Unbounded HTTP/1 response-header and chunked-trailer accumulation in Mint causes memory-exhaustion DoS CVSS 4.0HIGH 8.2

See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences