### Summary Mint's HTTP/1 request encoder splices the caller-supplied `method` and `target` directly into the request line without character validation. An application that forwards attacker-controlled input as the HTTP method or the target to `Mint.HTTP.request/5` is exposed to request-line CRLF injection, allowing the attacker to terminate the request line early, inject arbitrary headers, and pipeline a fully attacker-chosen second request onto the same TCP connection. ### Details `encode_request_line/2` in `lib/mint/http1/request.ex` writes `method` and `target` to the wire verbatim. `encode_headers/1` validates header names and values, but there is no equivalent `validate_method!/1`. Mint 1.7.0 added `validate_request_target/2`, which rejects CRLF and other control characters in `target` by default and closes the path/query vector. The `method` field remains unvalidated, so a CRLF-bearing method such as `"GET / HTTP/1.1\r\nX-Smuggled: 1\r\nGET /admin"` is accepted and written to the socket as-is. Bytes after the first `\r\n` are interpreted by the peer as an injected header, or, with a second `\r\n`, as an additional pipelined request. ### PoC 1. Stand up a Mint-using gateway/proxy that calls `Mint.HTTP.request(conn, method, "/", [], nil)` with `method` taken from caller input. 2. Send a request whose forwarded method is `"GET / HTTP/1.1\r\nX-Smuggled-Header: pwned\r\nGET /admin/delete-everything"`. 3. Observe the bytes received by the upstream server: the smuggled header line and the second request line appear verbatim in the outbound stream. ### Impact CRLF injection / HTTP request smuggling in the HTTP/1 client encoder, exploitable under default configuration whenever an application passes caller-influenced input as the HTTP method. An attacker who controls the method can inject arbitrary outbound headers (forged `Host`, `Authorization`, cache-poisoning headers) and smuggle additional, fully attacker-chosen requests to the upstream server over the same connection, potentially reaching endpoints the legitimate caller never intended to invoke. ## Resources * Introduction commit: https://github.com/elixir-mint/mint/commit/8db1acff30b6a9433762c18b1e1f891b8c1f74f7 * Patch commit: https://github.com/elixir-mint/mint/commit/fad091454cbb7449b19edb8e1fee12ca7cf28c3a
### Summary Mint's HTTP/1 request encoder splices the caller-supplied `method` and `target` directly into the request line without character validation. An application that forwards attacker-controlled input as the HTTP method or the target to `Mint.HTTP.request/5` is exposed to request-line CRLF injection, allowing the attacker to terminate the request line early, inject arbitrary headers, and pipeline a fully attacker-chosen second request onto the same TCP connection. ### Details `encode_request_line/2` in `lib/mint/http1/request.ex` writes `method` and `target` to the wire verbatim. `encode_headers/1` validates header names and values, but there is no equivalent `validate_method!/1`. Mint 1.7.0 added `validate_request_target/2`, which rejects CRLF and other control characters in `target` by default and closes the path/query vector. The `method` field remains unvalidated, so a CRLF-bearing method such as `"GET / HTTP/1.1\r\nX-Smuggled: 1\r\nGET /admin"` is accepted and written to the socket as-is. Bytes after the first `\r\n` are interpreted by the peer as an injected header, or, with a second `\r\n`, as an additional pipelined request. ### PoC 1. Stand up a Mint-using gateway/proxy that calls `Mint.HTTP.request(conn, method, "/", [], nil)` with `method` taken from caller input. 2. Send a request whose forwarded method is `"GET / HTTP/1.1\r\nX-Smuggled-Header: pwned\r\nGET /admin/delete-everything"`. 3. Observe the bytes received by the upstream server: the smuggled header line and the second request line appear verbatim in the outbound stream. ### Impact CRLF injection / HTTP request smuggling in the HTTP/1 client encoder, exploitable under default configuration whenever an application passes caller-influenced input as the HTTP method. An attacker who controls the method can inject arbitrary outbound headers (forged `Host`, `Authorization`, cache-poisoning headers) and smuggle additional, fully attacker-chosen requests to the upstream server over the same connection, potentially reaching endpoints the legitimate caller never intended to invoke. ## Resources * Introduction commit: https://github.com/elixir-mint/mint/commit/8db1acff30b6a9433762c18b1e1f891b8c1f74f7 * Patch commit: https://github.com/elixir-mint/mint/commit/fad091454cbb7449b19edb8e1fee12ca7cf28c3a
Update mint to 1.9.0 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanmint has potential CRLF injection in its HTTP request line via unvalidated `method`/`target` affects mint (erlang). Severity is low. ### Summary Mint's HTTP/1 request encoder splices the caller-supplied `method` and `target` directly into the request line without character validation. An application that forwards attacker-controlled input as the HTTP method or the target to `Mint.HTTP.request/5` is exposed to request-line CRLF injection, allowing the attacker to terminate the request line early, inject arbitrary headers, and pipeline a fully attacker-chosen second request onto the same TCP connection. ### Details `encode_request_line/2` in `lib/mint/http1/request.ex` writes `method` and `target` to the wire verbatim. `encode_headers/1` validates header names and values, but there is no equivalent `validate_method!/1`. Mint 1.7.0 added `validate_request_target/2`, which rejects CRLF and other control characters in `target` by default and closes the path/query vector. The `method` field remains unvalidated, so a CRLF-bearing method such as `"GET / HTTP/1.1\r\nX-Smuggled: 1\r\nGET /admin"` is accepted and written to the socket as-is. Bytes after the first `\r\n` are interpreted by the peer as an injected header, or, with a second `\r\n`, as an additional pipelined request. ### PoC 1. Stand up a Mint-using gateway/proxy that calls `Mint.HTTP.request(conn, method, "/", [], nil)` with `method` taken from caller input. 2. Send a request whose forwarded method is `"GET / HTTP/1.1\r\nX-Smuggled-Header: pwned\r\nGET /admin/delete-everything"`. 3. Observe the bytes received by the upstream server: the smuggled header line and the second request line appear verbatim in the outbound stream. ### Impact CRLF injection / HTTP request smuggling in the HTTP/1 client encoder, exploitable under default configuration whenever an application passes caller-influenced input as the HTTP method. An attacker who controls the method can inject arbitrary outbound headers (forged `Host`, `Authorization`, cache-poisoning headers) and smuggle additional, fully attacker-chosen requests to the upstream server over the same connection, potentially reaching endpoints the legitimate caller never intended to invoke. ## Resources * Introduction commit: https://github.com/elixir-mint/mint/commit/8db1acff30b6a9433762c18b1e1f891b8c1f74f7 * Patch commit: https://github.com/elixir-mint/mint/commit/fad091454cbb7449b19edb8e1fee12ca7cf28c3a
AI coding agents often install or upgrade packages automatically in erlang. A low vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| minterlang | <1.9.0 | 1.9.0 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate mint to 1.9.0 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanmint has potential CRLF injection in its HTTP request line via unvalidated `method`/`target` affects mint (erlang). Severity is low. ### Summary Mint's HTTP/1 request encoder splices the caller-supplied `method` and `target` directly into the request line without character validation. An application that forwards attacker-controlled input as the HTTP method or the target to `Mint.HTTP.request/5` is exposed to request-line CRLF injection, allowing the attacker to terminate the request line early, inject arbitrary headers, and pipeline a fully attacker-chosen second request onto the same TCP connection. ### Details `encode_request_line/2` in `lib/mint/http1/request.ex` writes `method` and `target` to the wire verbatim. `encode_headers/1` validates header names and values, but there is no equivalent `validate_method!/1`. Mint 1.7.0 added `validate_request_target/2`, which rejects CRLF and other control characters in `target` by default and closes the path/query vector. The `method` field remains unvalidated, so a CRLF-bearing method such as `"GET / HTTP/1.1\r\nX-Smuggled: 1\r\nGET /admin"` is accepted and written to the socket as-is. Bytes after the first `\r\n` are interpreted by the peer as an injected header, or, with a second `\r\n`, as an additional pipelined request. ### PoC 1. Stand up a Mint-using gateway/proxy that calls `Mint.HTTP.request(conn, method, "/", [], nil)` with `method` taken from caller input. 2. Send a request whose forwarded method is `"GET / HTTP/1.1\r\nX-Smuggled-Header: pwned\r\nGET /admin/delete-everything"`. 3. Observe the bytes received by the upstream server: the smuggled header line and the second request line appear verbatim in the outbound stream. ### Impact CRLF injection / HTTP request smuggling in the HTTP/1 client encoder, exploitable under default configuration whenever an application passes caller-influenced input as the HTTP method. An attacker who controls the method can inject arbitrary outbound headers (forged `Host`, `Authorization`, cache-poisoning headers) and smuggle additional, fully attacker-chosen requests to the upstream server over the same connection, potentially reaching endpoints the legitimate caller never intended to invoke. ## Resources * Introduction commit: https://github.com/elixir-mint/mint/commit/8db1acff30b6a9433762c18b1e1f891b8c1f74f7 * Patch commit: https://github.com/elixir-mint/mint/commit/fad091454cbb7449b19edb8e1fee12ca7cf28c3a
AI coding agents often install or upgrade packages automatically in erlang. A low vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| minterlang | <1.9.0 | 1.9.0 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard