Elixir-mint Mint vulnerabilities

• elixir-mint mint Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediaries CVE-2026-94194 Fix available 6.3 MediumSeptember 28, 2026
• elixir-mint mint Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size CVE-2026-92103 Fix available 6.3 MediumSeptember 28, 2026
• elixir-mint mint HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memory CVE-2026-91043 Fix available 8.2 HighSeptember 28, 2026
• elixir-mint mint Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connections CVE-2026-82672 Fix available 6.3 MediumSeptember 19, 2026
• elixir-mint mint Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS CVE-2026-82728 Fix available 8.2 HighSeptember 4, 2026
• elixir-mint mint Quadratic chunk-size parsing in Mint.HTTP1.Parse allows CPU-exhaustion DoS CVE-2026-82729 Fix available 6.3 MediumSeptember 4, 2026
• elixir-mint mint Sign-tolerant HTTP/1 chunk-size parser in Mint enables response smuggling against strict intermediaries on pooled connections CVE-2026-59249 Fix available 6.3 MediumJuly 16, 2026
• elixir-mint mint Zero-length HTTP/2 CONTINUATION frames bypass Mint's header-block byte-size cap and exhaust client memory CVE-2026-59246 Fix available 6.3 MediumJuly 14, 2026
• elixir-mint mint Unbounded HTTP/1 response-header and chunked-trailer accumulation in Mint causes memory-exhaustion DoS CVE-2026-58229 Fix available 8.2 HighJuly 14, 2026
• elixir-mint mint mint buffers an entire chunked response chunk in memory in Mint.HTTP1.decode_body/5 CVE-2026-56810 Fix available 8.7 HighJuly 6, 2026
• elixir-mint mint HTTP response smuggling in Mint HTTP/1 client via lenient Content-Length parsing CVE-2026-49753 Fix available 6.3 MediumJune 2, 2026
• elixir-mint mint HTTP/2 CONTINUATION flood in Mint client via unbounded header-block accumulation CVE-2026-49754 Fix available 8.2 HighJune 2, 2026
• elixir-mint mint Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrency CVE-2026-48862 Fix available 8.2 HighJune 2, 2026
• elixir-mint mint CRLF injection in HTTP/1 request line via unvalidated method in Mint CVE-2026-48861 Fix available 2.1 LowJune 2, 2026