The vulnerability in elixir-mint mint (versions >=0.1.0 and <1.10.1) stems from Mint.HTTP1.Parse.chunk_size/1 accepting chunk size lines that contain arbitrary bytes after the initial hexadecimal digits, contrary to RFC 9112 which permits only semicolon-introduced chunk extensions. For example, lines like '5ZZZZZ' or '5 9' are accepted as chunk size 5, and '0ZZZZ' as the terminating chunk. Strict intermediaries reject such lines, causing them to interpret chunk boundaries differently than Mint. This discrepancy allows a malicious HTTP/1 server to desynchronize the Mint client and a strict intermediary on a pooled connection, enabling response-queue poisoning attacks against subsequent requests sharing that connection.

A malicious HTTP/1 server can exploit this vulnerability to desynchronize the Mint client and a strict intermediary, leading to response-queue poisoning on pooled connections. This can cause the client to receive incorrect or malicious responses for subsequent requests, potentially impacting data integrity and application behavior. The CVSS 4.0 score is 6.3 (medium), reflecting network attack vector, low complexity, partial attack and impact requirements, and limited confidentiality and integrity impact.

No official patch or vendor advisory is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using vulnerable versions of elixir-mint mint in environments where strict intermediaries are present or where pooled HTTP/1 connections are used with untrusted servers.