Elixir Mint 1.10.1 Fixes HTTP Response-Smuggling Parsing Flaw
Tech GuruQuick Answer
The Mint project released version 1.10.1 to correct HTTP/1 chunk-size-line validation that can create response-framing disagreement with a stricter intermediary. The project rates CVE-2026-82672 Medium at 6.3 under CVSS v4.0. Applications using Mint 1.10.0 or earlier should establish whether the vulnerable dependency and relevant pooled HTTP/1 intermediary path are present, then move to the supported fixed release.
Validate The Dependency And Traffic Path
What to do now: Record the deployed Mint version from each application lockfile or runtime artifact, identify HTTP/1 connections that traverse pooled intermediaries, and update affected applications to 1.10.1 through the normal dependency and release process.
Last verified: 2026-09-20 UTC. Recheck the project advisory before changing production.
Scope And Authority
| Product scope | Elixir Mint HTTP client versions through 1.10.0 |
|---|---|
| Advisory | GHSA-rj5m-69wp-cxq9 |
| CVE | CVE-2026-82672 |
| Authoritative release date | 2026-09-19 17:00:11 UTC |
| Authority revision date | 2026-09-19 |
| Fixed version | 1.10.1 |
| CVSS base score | 6.3 (CVSS v4.0) |
| CVSS severity | Medium |
| Exploitation status | Not stated by the Mint project; no exploitation claim is inferred. |
What Changed
Mint's prior chunked-body decoder accepted bytes after the hexadecimal chunk size that RFC 9112 does not permit unless they form a valid chunk extension. A malicious origin, a stricter intermediary, and a pooled keep-alive connection can therefore disagree about response boundaries. The project notes that it did not construct a smuggling chain against a specific intermediary; that limitation must be retained when assessing risk.
Version 1.10.1 validates the chunk-extension grammar and rejects an invalid tail. The advisory identifies <= 1.10.0 as vulnerable and 1.10.1 as patched.
What To Validate Now
- Inventory. Locate direct and transitive Mint dependencies in lockfiles, software bills of materials, release artifacts, and running services.
- Establish applicability. Confirm the exact Mint version and whether traffic uses HTTP/1 through a pooled intermediary; do not infer exposure from the CVE alone.
- Remediate. Update to Mint
1.10.1using the application's supported dependency workflow, rebuild immutable artifacts, and redeploy through normal change control. - Validate. Confirm the resolved dependency and deployed artifact, then exercise representative HTTP, proxy, retry, pooling, and error-handling paths.
- Contain if delayed. Where an immediate update is not possible, avoid untrusted origins and affected pooled intermediary paths only when that control is operationally supported and testable; treat it as temporary.
Operational Cautions
A lockfile edit does not prove that every deployed artifact changed. Preserve dependency-resolution output and verify the version inside the released artifact. Test connection pooling and proxy behavior before broad deployment, and retain a rollback path that does not restore the vulnerable dependency.
Evidence To Retain
- Asset, service, environment, and owner identifiers used for the applicability decision.
- UTC timestamps and before-and-after package or dependency versions.
- Change approval, package-manager or build output, validation results, and any exception or rollback record.
- The authoritative advisory and security-tracker evidence used at the time of the decision.
Related TechGeeks Resources
Authoritative References
Correction policy: If the Mint project changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
