« Volver al listado

CVE-2026-49753

Estado: AplazadaMedia (6.3)—

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint Mint allows attacker-controlled HTTP/1 servers to desynchronise response framing on shared connections.

Mint's HTTP/1 Content-Length parser, Mint.HTTP1.Parse.content_length_header/1 in lib/mint/http1/parse.ex, parses the header value with Integer.parse/1, which accepts an optional + or - sign prefix. The length >= 0 guard rejects negatives, but inputs such as +0 or +123 are returned as valid lengths. RFC 7230 specifies Content-Length = 1*DIGIT, with no sign character permitted.

A fronting proxy or load balancer that strictly enforces the grammar will reject or reframe a header like Content-Length: +0, while Mint silently treats it as zero.

Leer descripción completaMostrar menos

When Mint reuses the socket (keep-alive, pipelining, or any pooled connection shared across requesters), the parser disagreement is a response-smuggling primitive: the proxy delimits the body one way, Mint another, and bytes from one response get attributed to the next. Where the same Mint connection is shared across trust boundaries, an attacker-controlled upstream can leak bytes into a different consumer's response stream.

This issue affects mint: from 0.1.0 before 1.9.0.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Elixir — MintAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-49753",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-49753",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-02T18:06:41.525477Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 6.3,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "LOW",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*"
          ],
          "repo": "https://github.com/elixir-mint/mint",
          "vendor": "elixir-mint",
          "modules": [
            "'Elixir.Mint.HTTP1.Parse'"
          ],
          "product": "mint",
          "versions": [
            {
              "status": "affected",
              "version": "0.1.0",
              "lessThan": "1.9.0",
              "versionType": "semver"
            }
          ],
          "packageURL": "pkg:hex/mint",
          "packageName": "mint",
          "programFiles": [
            "lib/mint/http1/parse.ex"
          ],
          "collectionURL": "https://repo.hex.pm",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "'Elixir.Mint.HTTP1.Parse':content_length_header/1"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*"
          ],
          "repo": "https://github.com/elixir-mint/mint.git",
          "vendor": "elixir-mint",
          "modules": [
            "'Elixir.Mint.HTTP1.Parse'"
          ],
          "product": "mint",
          "versions": [
            {
              "status": "affected",
              "version": "65e0e86d799a6d3b08e4372fccdd9747535e0dd6",
              "lessThan": "47e48027480228e4e32a0b4df39db497b4804921",
              "versionType": "git"
            }
          ],
          "packageURL": "pkg:github/elixir-mint/mint",
          "packageName": "elixir-mint/mint",
          "programFiles": [
            "lib/mint/http1/parse.ex"
          ],
          "collectionURL": "https://github.com",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "'Elixir.Mint.HTTP1.Parse':content_length_header/1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-06-02T16:16:44.777",
  "references": [
    {
      "url": "https://cna.erlef.org/cves/CVE-2026-49753.html",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/elixir-mint/mint/commit/47e48027480228e4e32a0b4df39db497b4804921",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/elixir-mint/mint/security/advisories/GHSA-mjqx-c6f6-7rc2",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-49753",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/elixir-mint/mint/security/advisories/GHSA-mjqx-c6f6-7rc2",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "description": [
        {
          "lang": "en",
          "value": "CWE-444"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint Mint allows attacker-controlled HTTP/1 servers to desynchronise response framing on shared connections.\n\nMint's HTTP/1 Content-Length parser, Mint.HTTP1.Parse.content_length_header/1 in lib/mint/http1/parse.ex, parses the header value with Integer.parse/1, which accepts an optional + or - sign prefix. The length >= 0 guard rejects negatives, but inputs such as +0 or +123 are returned as valid lengths. RFC 7230 specifies Content-Length = 1*DIGIT, with no sign character permitted.\n\nA fronting proxy or load balancer that strictly enforces the grammar will reject or reframe a header like Content-Length: +0, while Mint silently treats it as zero. When Mint reuses the socket (keep-alive, pipelining, or any pooled connection shared across requesters), the parser disagreement is a response-smuggling primitive: the proxy delimits the body one way, Mint another, and bytes from one response get attributed to the next. Where the same Mint connection is shared across trust boundaries, an attacker-controlled upstream can leak bytes into a different consumer's response stream.\n\nThis issue affects mint: from 0.1.0 before 1.9.0."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de 'Interpretación inconsistente de solicitudes HTTP' ('Contrabando de Solicitudes/Respuestas HTTP') en elixir-mint Mint permite a servidores HTTP/1 controlados por el atacante desincronizar el enmarcado de respuestas en conexiones compartidas.\n\nEl analizador Content-Length HTTP/1 de Mint, Mint.HTTP1.Parse.content_length_header/1 en lib/mint/http1/parse.ex, analiza el valor del encabezado con Integer.parse/1, que acepta un prefijo de signo + o - opcional. La guarda length >= 0 rechaza los negativos, pero entradas como +0 o +123 se devuelven como longitudes válidas. RFC 7230 especifica Content-Length = 1DIGIT, sin permitir ningún carácter de signo.\n\nUn proxy frontal o balanceador de carga que aplica estrictamente la gramática rechazará o reenmarcará un encabezado como Content-Length: +0, mientras que Mint lo trata silenciosamente como cero. Cuando Mint reutiliza el socket (keep-alive, pipelining, o cualquier conexión agrupada compartida entre solicitantes), el desacuerdo del analizador es una primitiva de contrabando de respuestas: el proxy delimita el cuerpo de una manera, Mint de otra, y los bytes de una respuesta se atribuyen a la siguiente. Donde la misma conexión de Mint se comparte a través de límites de confianza, un upstream controlado por el atacante puede filtrar bytes en el flujo de respuesta de un consumidor diferente.\n\nEste problema afecta a mint: desde 0.1.0 antes de 1.9.0."
    }
  ],
  "lastModified": "2026-07-22T19:10:00.120",
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
}