PT-2026-45784 · Mint · Mint

Eric Meadows-Jönsson + 1 · Published 2026-06-02 · Updated 2026-06-02 · CVE-2026-48861

Positive Technologies (AI Summary)

CVSS v4.0

2.1

Low

Base vector

AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions mint versions 0.1.0 through 1.8.x

Description Improper Neutralization of CRLF Sequences, also known as CRLF Injection, allows HTTP Request Splitting and HTTP Request Smuggling. In the encode request line/2 function within lib/mint/http1/request.ex, the method and target arguments are spliced directly into the HTTP/1 request line without character validation. Applications forwarding attacker-controlled input as the HTTP method or target to the Mint.HTTP.request/5 function are exposed to request-line CRLF injection. This enables an attacker to terminate the request line prematurely, inject arbitrary headers, and smuggle a separate pipelined HTTP request over the same TCP connection. While the validate request target/2 function introduced in version 1.7.0 rejects CRLF and control characters in the target by default, the method field remains unvalidated across all versions.

Recommendations Update to version 1.9.0 or later.

Fix

Weakness Enumeration

CWE-93

Related Identifiers

CVE-2026-48861

GHSA-2PG6-44CX-C49V

Affected Products

Mint

References · 6

• https://osv.dev/vulnerability/EEF-CVE-2026-48861 · Vendor Advisory
• https://github.com/elixir-mint/mint/commit/fad091454cbb7449b19edb8e1fee12ca7cf28c3a · Patch
• https://github.com/elixir-mint/mint/security/advisories/GHSA-2pg6-44cx-c49v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-48861 · Security Note
• https://hex.pm/packages/mint · Note
• https://cna.erlef.org/cves/CVE-2026-48861.html · Note