CVE-2026-49753 HTTP response smuggling in Mint HTTP/1 client via lenient Content-Length parsing

[
  {
    "collectionURL": "https://repo.hex.pm",
    "cpes": [
      "cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "'Elixir.Mint.HTTP1.Parse'"
    ],
    "packageName": "mint",
    "packageURL": "pkg:hex/mint",
    "product": "mint",
    "programFiles": [
      "lib/mint/http1/parse.ex"
    ],
    "programRoutines": [
      {
        "name": "'Elixir.Mint.HTTP1.Parse':content_length_header/1"
      }
    ],
    "repo": "https://github.com/elixir-mint/mint",
    "vendor": "elixir-mint",
    "versions": [
      {
        "lessThan": "1.9.0",
        "status": "affected",
        "version": "0.1.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "collectionURL": "https://github.com",
    "cpes": [
      "cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "'Elixir.Mint.HTTP1.Parse'"
    ],
    "packageName": "elixir-mint/mint",
    "packageURL": "pkg:github/elixir-mint/mint",
    "product": "mint",
    "programFiles": [
      "lib/mint/http1/parse.ex"
    ],
    "programRoutines": [
      {
        "name": "'Elixir.Mint.HTTP1.Parse':content_length_header/1"
      }
    ],
    "repo": "https://github.com/elixir-mint/mint.git",
    "vendor": "elixir-mint",
    "versions": [
      {
        "lessThan": "47e48027480228e4e32a0b4df39db497b4804921",
        "status": "affected",
        "version": "65e0e86d799a6d3b08e4372fccdd9747535e0dd6",
        "versionType": "git"
      }
    ]
  }
]