Eelixir-mint

Products

Exploited and recent CVEs

• CVE-2026-94194 Medium 6.3 Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediaries 0.4%
• CVE-2026-92103 Medium 6.3 Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size 0.3%
• CVE-2026-91043 High 8.2 HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memory 0.4%
• CVE-2026-82672 Medium 6.3 Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connections 0.5%
• CVE-2026-82728 High 8.2 Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS 0.5%
• CVE-2026-82729 Medium 6.3 Quadratic chunk-size parsing in Mint.HTTP1.Parse allows CPU-exhaustion DoS 0.5%
• CVE-2026-59249 Medium 6.3 Sign-tolerant HTTP/1 chunk-size parser in Mint enables response smuggling against strict intermediaries on pooled connections 0.5%
• CVE-2026-59246 Medium 6.3 Zero-length HTTP/2 CONTINUATION frames bypass Mint's header-block byte-size cap and exhaust client memory 0.5%
• CVE-2026-58229 High 8.2 Unbounded HTTP/1 response-header and chunked-trailer accumulation in Mint causes memory-exhaustion DoS 0.5%
• CVE-2026-56810 High 8.7 mint buffers an entire chunked response chunk in memory in Mint.HTTP1.decode_body/5 0.4%
• CVE-2026-58226 High 8.7 Unauthenticated denial-of-service via unbounded HPACK integer decoding in hpax 0.6%
• CVE-2026-49753 Medium 6.3 HTTP response smuggling in Mint HTTP/1 client via lenient Content-Length parsing 0.3%
• CVE-2026-49754 High 8.2 HTTP/2 CONTINUATION flood in Mint client via unbounded header-block accumulation 0.4%
• CVE-2026-48862 High 8.2 Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrency 0.4%
• CVE-2026-48861 Low 2.1 CRLF injection in HTTP/1 request line via unvalidated method in Mint 0.2%