https://vulnerability.circl.lu/sightings/feed 2026-07-12T03:57:23.342877+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/d87b2d30-9455-4546-874c-a8251f62071d/export 2026-07-12T03:57:23.366314+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "d87b2d30-9455-4546-874c-a8251f62071d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49753", "type": "seen", "source": "https://gist.github.com/alon710/bc442ee88dc103da228f4212da5b648e", "content": "# CVE-2026-49753: CVE-2026-49753: HTTP Request/Response Smuggling via Inconsistent Content-Length Parsing in Elixir Mint Client\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-07-09\n> **Full Report:** https://cvereports.com/reports/CVE-2026-49753\n\n## Summary\nAn Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling) vulnerability in the Elixir Mint HTTP client allows attacker-controlled HTTP/1 servers to desynchronize response framing on shared connections due to over-lenient parsing of sign-prefixed Content-Length headers.\n\n## TL;DR\nElixir Mint's parser accepted sign-prefixed Content-Length values (like '+100') due to using Integer.parse/1. Intermediaries strictly enforcing RFC 7230/9110 reject or reframe these headers, enabling HTTP response smuggling and connection poisoning.\n\n## Technical Details\n\n- **CWE ID**: CWE-444\n- **Attack Vector**: Network\n- **CVSS v4.0**: 6.3\n- **EPSS Score**: 0.00301\n- **Impact**: HTTP Request/Response Smuggling\n- **Exploit Status**: None\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- elixir-mint/mint\n- **mint**: >= 0.1.0, < 1.9.0 (Fixed in: `1.9.0`)\n\n## Mitigation\n\n- Update elixir-mint/mint to version 1.9.0 or later.\n- Deploy strict WAF rules to drop sign-prefixed Content-Length headers.\n- Avoid connection pooling across distinct security context boundaries when interacting with untrusted upstream hosts.\n\n**Remediation Steps:**\n1. Identify projects using Mint by auditing mix.lock.\n2. Update mix.exs dependencies to require {:mint, '~> 1.9.0'}.\n3. Run mix deps.get to fetch the patched version.\n4. Validate HTTP header processing in downstream environments to ensure strict RFC compliance.\n\n## References\n\n- [GHSA-mjqx-c6f6-7rc2 Security Advisory](https://github.com/elixir-mint/mint/security/advisories/GHSA-mjqx-c6f6-7rc2)\n- [Erlang Ecosystem Foundation CVE Entry](https://cna.erlef.org/cves/CVE-2026-49753.html)\n- [OSV Database Entry](https://osv.dev/vulnerability/EEF-CVE-2026-49753)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-49753) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-10T03:41:59.453584Z"} 2026-07-10T03:41:59.453584+00:00 https://vulnerability.circl.lu/sighting/cad41cd3-8b26-49f8-9148-a1217dbd6c3e/export 2026-07-12T03:57:23.367874+00:00 Joseph Lee https://cvepremium.circl.lu/user/syspect {"uuid": "cad41cd3-8b26-49f8-9148-a1217dbd6c3e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-49753", "type": "published-proof-of-concept", "source": "https://github.com/elixir-mint/mint/security/advisories/GHSA-mjqx-c6f6-7rc2", "content": "", "creation_timestamp": "2026-07-10T00:35:19.212783Z"} 2026-07-10T00:35:19.212783+00:00