CVE-2026-94194Published
Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediaries
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-94194 · Microsoft / collected KEV context
cve-program · CVE-2026-94194
- https://github.com/elixir-mint/mint/security/advisories/GHSA-gvrc-75rc-7gj9
- https://cna.erlef.org/cves/CVE-2026-94194.html
- https://osv.dev/vulnerability/EEF-CVE-2026-94194
- https://github.com/elixir-mint/mint/commit/60089586ec7adc9fddb09f69a2f5919ba9ac7f33
- https://github.com/elixir-mint/mint/commit/2ec8b696b5475ecbdaa87c0098957bca339e17c0
- https://github.com/elixir-mint/mint/commit/8d1bbcfa566a8c1dc23d33f40d550c28250ac7b9
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.