CVE-2026-48596 · published 2026-06-02 · updated 2026-06-04

CRLF injection in Tesla.Multipart.add_content_type_param/2 allows HTTP header injection

LOW 2.1 CWE-113 · Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
OSV.dev JSON

Am I affected?

type your tesla version to check

Description

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2.

Tesla.Multipart.add_content_type_param/2 appends caller-supplied strings to the multipart content_type_params list without validating for CR (\r) or LF (\n) characters. Tesla.Multipart.headers/1 then joins these params verbatim with "; " to construct the outgoing Content-Type header value. A param containing \r\n splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into add_content_type_param/2 is affected.

This issue affects tesla: from 0.8.0 before 1.18.3.

Weaknesses & attack patterns

Weakness

CWE-113 · Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') in catalog → MITRE ↗

Attack patterns

CAPEC-105 · HTTP Request Splitting MITRE ↗

Affected — Hex / tesla Hex.pm ↗ Repository ↗

≥ 0.8.0 < 1.18.3 affected
every other version: unaffected
cpe cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*
modules · source files · routines
modules 'Elixir.Tesla.Multipart'
source files lib/tesla/multipart.ex
routines 'Elixir.Tesla.Multipart':add_content_type_param/2 · 'Elixir.Tesla.Multipart':headers/1

Affected — GitHub / elixir-tesla/tesla Repository ↗

≥ 6ebfdb9 < 23601ed affected
every other version: unaffected
cpe cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*
modules · source files · routines
modules 'Elixir.Tesla.Multipart'
source files lib/tesla/multipart.ex
routines 'Elixir.Tesla.Multipart':add_content_type_param/2 · 'Elixir.Tesla.Multipart':headers/1

Workarounds

Validate content-type parameter strings before passing them to Tesla.Multipart.add_content_type_param/2, rejecting any value that contains \r or \n.

Configurations

The application must pass untrusted input into Tesla.Multipart.add_content_type_param/2.

References

github.com/elixir-tesla/tesla · GHSA-q7jx-v53g-848w ↗ vendor-advisory
github.com/elixir-tesla/tesla · 23601ed ↗ patch
osv.dev · EEF-CVE-2026-48596 ↗ related

Credits

Peter Ullrich Finder
Yordis Prieto Remediation developer
Jonatan Männchen Analyst

CVSS breakdown

LOW 2.1 open in calculator →
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
« All CVEs