# mint (Hex) vulnerabilities

14 known vulnerabilities (6 high, 7 medium, 1 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://hex.pm/packages/mint

## Advisories (14)

### [CVE-2026-94194](https://cve.now/CVE-2026-94194): Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediaries

- Severity: Medium 6.3
- Published: Sep 28, 2026
- Affected: from 0.1.0, fixed in 1.10.2.

### [CVE-2026-92103](https://cve.now/CVE-2026-92103): Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max\_frame\_size

- Severity: Medium 6.3
- Published: Sep 28, 2026
- Affected: from 0.1.0, fixed in 1.10.2.

### [CVE-2026-91043](https://cve.now/CVE-2026-91043): HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max\_header\_list\_size and exhaust client memory

- Severity: High 8.2
- Published: Sep 28, 2026
- Affected: from 1.1.0, fixed in 1.10.2.

### [CVE-2026-82672](https://cve.now/CVE-2026-82672): Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connections

- Severity: Medium 6.3
- Published: Sep 19, 2026
- Affected: from 0.1.0, fixed in 1.10.1; from 0.1.0, fixed in 1.10.1.

### [CVE-2026-82728](https://cve.now/CVE-2026-82728): Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS

- Severity: High 8.2
- Published: Sep 4, 2026
- Affected: from 0.1.0, fixed in 1.10.0; from 0.1.0, fixed in 1.10.0.

### [CVE-2026-82729](https://cve.now/CVE-2026-82729): Quadratic chunk-size parsing in Mint.HTTP1.Parse allows CPU-exhaustion DoS

- Severity: Medium 6.3
- Published: Sep 4, 2026
- Affected: from 1.9.3, fixed in 1.10.0; from 1.9.3, fixed in 1.10.0.

### [CVE-2026-59249](https://cve.now/CVE-2026-59249): Sign-tolerant HTTP/1 chunk-size parser in Mint enables response smuggling against strict intermediaries on pooled connections

- Severity: Medium 6.3
- Published: Jul 16, 2026
- Affected: from 0.1.0, fixed in 1.9.3; from 0.1.0, fixed in 1.9.3.

### [CVE-2026-59246](https://cve.now/CVE-2026-59246): Zero-length HTTP/2 CONTINUATION frames bypass Mint's header-block byte-size cap and exhaust client memory

- Severity: Medium 6.3
- Published: Jul 14, 2026
- Affected: from 0.1.0, fixed in 1.9.2; from 0.1.0, fixed in 1.9.2.

### [CVE-2026-58229](https://cve.now/CVE-2026-58229): Unbounded HTTP/1 response-header and chunked-trailer accumulation in Mint causes memory-exhaustion DoS

- Severity: High 8.2
- Published: Jul 14, 2026
- Affected: from 0.1.0, fixed in 1.9.2; from 0.1.0, fixed in 1.9.2.

### [CVE-2026-56810](https://cve.now/CVE-2026-56810): mint buffers an entire chunked response chunk in memory in Mint.HTTP1.decode\_body/5

- Severity: High 8.7
- Published: Jul 6, 2026
- Affected: from 0.5.0, fixed in 1.9.1; from 0.5.0, fixed in 1.9.1.

### [CVE-2026-49753](https://cve.now/CVE-2026-49753): HTTP response smuggling in Mint HTTP/1 client via lenient Content-Length parsing

- Severity: Medium 6.3
- Published: Jun 2, 2026
- Affected: from 0.1.0, fixed in 1.9.0; fixed in 1.9.0; from 0.1.0, fixed in 1.9.0.

### [CVE-2026-49754](https://cve.now/CVE-2026-49754): HTTP/2 CONTINUATION flood in Mint client via unbounded header-block accumulation

- Severity: High 8.2
- Published: Jun 2, 2026
- Affected: from 0.1.0, fixed in 1.9.0; fixed in 1.9.0; from 0.1.0, fixed in 1.9.0.

### [CVE-2026-48862](https://cve.now/CVE-2026-48862): Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH\_PROMISE concurrency

- Severity: High 8.2
- Published: Jun 2, 2026
- Affected: from 0.2.0, fixed in 1.9.0; from 0.2.0, fixed in 1.9.0.

### [CVE-2026-48861](https://cve.now/CVE-2026-48861): CRLF injection in HTTP/1 request line via unvalidated method in Mint

- Severity: Low 2.1
- Published: Jun 2, 2026
- Affected: from 0.1.0, fixed in 1.9.0; fixed in 1.9.0; from 0.1.0, fixed in 1.9.0.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/hex/mint
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.