The vulnerability in elixir-mint mint (CVE-2026-59249) stems from the Mint.HTTP1.decode_body/5 function parsing chunk-size lines in Transfer-Encoding: chunked responses using Integer.parse(data, 16), which accepts optional leading '+' or '-' signs. RFC 7230 forbids such signs in chunk-size values. Consequently, an RFC-strict intermediary rejects chunk-size lines with these signs, while Mint accepts them, causing the client and intermediary to disagree on where one response ends and the next begins. On a pooled keep-alive connection, a malicious HTTP/1 server can exploit this to inject bytes that the Mint client attributes incorrectly to subsequent responses, resulting in response-queue poisoning and corrupted responses for unrelated requests. This affects all mint versions from 0.1.0 up to 1.9.3.

An attacker controlling an HTTP/1 server can exploit this vulnerability to desynchronize the Mint client and intermediaries, leading to response-queue poisoning on pooled keep-alive connections. This can cause the client to receive corrupted or maliciously altered responses for unrelated requests, potentially impacting data integrity and application behavior relying on these HTTP responses.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using affected versions of mint (0.1.0 through before 1.9.3) in environments where untrusted HTTP/1 servers are present or consider disabling HTTP/1 connection pooling if possible. Monitor vendor communications for updates and apply patches promptly once released.