The vulnerability in elixir-mint mint involves the Mint.HTTP1.decode_body/5 function parsing chunk-size lines in Transfer-Encoding: chunked responses using Integer.parse(data, 16), which accepts optional leading '+' or '-' signs. RFC 7230 forbids such signs in chunk-size lines. Strict intermediaries reject these signed chunk sizes, causing a mismatch in response boundary interpretation between the intermediary and the Mint client. On a pooled keep-alive connection, this desynchronization allows an attacker-controlled HTTP/1 server to inject bytes that the Mint client attributes to the next legitimate response, resulting in response queue poisoning and corruption of unrelated in-flight request responses. This affects mint versions from 0.1.0 up to but not including 1.9.3.

An attacker controlling an HTTP/1 server can exploit this vulnerability to desynchronize the Mint client and strict intermediaries, poisoning the response queue on a pooled connection. This leads to corrupted or maliciously altered responses being delivered to unrelated requests sharing the connection, potentially undermining application logic or data integrity relying on those responses.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch link is provided in the available data. Users should monitor vendor communications for updates and consider avoiding use of affected versions or disabling HTTP/1 connection pooling if feasible until a fix is released.