https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 22:38:58 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-94194 <p>Inconsistent Interpretation of HTTP Requests (&#39;HTTP Request/Response Smuggling&#39;) vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize an intermediary and the Mint client on a pooled connection, poisoning the responses to subsequent requests that share the connection.</p> <p>message_body/1 in lib/mint/http1.ex selects chunked framing when chunked is the first coding listed in a response&#39;s Transfer-Encoding fields. RFC 9112 section 6.3 applies chunked framing only when chunked is the final coding, and otherwise reads the body until the server closes the connection. For a response such as Transfer-Encoding: chunked, gzip, an intermediary that follows the RFC treats every byte up to the close as the body, while Mint ends the body at the zero-length chunk and parses the remaining bytes as the response to the next request on the connection.</p> <p>Mint also keeps the connection open after an HTTP/1.0 response, final or 1xx, that carries Transfer-Encoding and Connection: keep-alive. RFC 9112 section 6.1 requires treating the framing of such a message as faulty and closing the connection after it, so bytes after its chunked body are parsed as the response to the next request in the same way.</p> <p>This issue affects mint: from 0.1.0 before 1.10.2.</p> <p>Inconsistent Interpretation of HTTP Requests (&#39;HTTP Request/Response Smuggling&#39;) vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize an intermediary and the Mint client on a pooled connection, poisoning the responses to subsequent requests that share the connection.</p> <p>message_body/1 in lib/mint/http1.ex selects chunked framing when chunked is the first coding listed in a response&#39;s Transfer-Encoding fields. RFC 9112 section 6.3 applies chunked framing only when chunked is the final coding, and otherwise reads the body until the server closes the connection. For a response such as Transfer-Encoding: chunked, gzip, an intermediary that follows the RFC treats every byte up to the close as the body, while Mint ends the body at the zero-length chunk and parses the remaining bytes as the response to the next request on the connection.</p> <p>Mint also keeps the connection open after an HTTP/1.0 response, final or 1xx, that carries Transfer-Encoding and Connection: keep-alive. RFC 9112 section 6.1 requires treating the framing of such a message as faulty and closing the connection after it, so bytes after its chunked body are parsed as the response to the next request in the same way.</p> <p>This issue affects mint: from 0.1.0 before 1.10.2.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-94194