The vulnerability in elixir-mint Mint (CVE-2026-48861) is an improper neutralization of CRLF sequences (CWE-93) in the HTTP request line construction. Specifically, the encode_request_line/2 function concatenates the HTTP method and target directly into the request line without validating the method for CRLF or control characters. Although Mint 1.7.0 introduced validation for the target field, the method field remains unvalidated by default, enabling attackers to inject CRLF sequences via the method parameter. This allows premature termination of the request line, injection of arbitrary headers, and smuggling of additional HTTP requests on the same TCP connection. The vulnerability affects Mint versions from 0.1.0 before 1.9.0.

An attacker who can control the HTTP method parameter passed to Mint.HTTP.request/5 can exploit this vulnerability to perform HTTP request splitting and HTTP request smuggling. This may allow injection of arbitrary HTTP headers and pipelining of malicious requests over the same TCP connection. The CVSS 4.0 score is 2.1 (low severity) with local attack vector and low impact on confidentiality and integrity. No known exploits are reported in the wild.

No official patch or fix is currently documented for this vulnerability. Mint 1.7.0 introduced validation for the request target but did not validate the method field, which remains exploitable by default. Users should avoid passing untrusted input as the HTTP method to Mint.HTTP.request/5. Monitor vendor advisories for updates or patches addressing method validation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.