{"vulnerability": "cve-2026-4859", "sightings": [{"uuid": "95f2fa8b-7597-41a0-bee2-9dd6060b08f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48597", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mndhnkma2l2j", "content": "CVE-2026-48597 - Atom table exhaustion via untrusted URL scheme in Tesla.Adapter.Mint\nCVE ID : CVE-2026-48597\n \n Published : June 2, 2026, 7:08 p.m. | 1\u00a0hour, 16\u00a0minutes ago\n \n Description : Allocation of Resources Without Limits or Throttling vulnerability in elixir-tesla tes...", "creation_timestamp": "2026-06-02T20:46:17.191015Z"}, {"uuid": "3a305021-c9c3-4c1c-82e8-2eb6665b0487", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48595", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mndhqfcwzz23", "content": "CVE-2026-48595 - Authorization header leaks to third-party origin on cross-origin redirect in Tesla.Middleware.FollowRedirects\nCVE ID : CVE-2026-48595\n \n Published : June 2, 2026, 7:08 p.m. | 1\u00a0hour, 16\u00a0minutes ago\n \n Description : Improper Handling of Case Sensitivity vulnera...", "creation_timestamp": "2026-06-02T20:47:52.286572Z"}, {"uuid": "48dd0006-b33f-4155-88c7-f2d6109e337b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48598", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mndhzwkych27", "content": "CVE-2026-48598 - CRLF injection in Tesla.Multipart disposition parameters allows multipart part header injection\nCVE ID : CVE-2026-48598\n \n Published : June 2, 2026, 7:08 p.m. | 1\u00a0hour, 16\u00a0minutes ago\n \n Description : Improper Encoding or Escaping of Output vulnerability in el...", "creation_timestamp": "2026-06-02T20:53:12.402046Z"}, {"uuid": "d6c4bf2f-ab0c-449c-ab48-58af2f946100", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48594", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mndk2jnfci2o", "content": "CVE-2026-48594 - Decompression bomb in Tesla.Middleware.DecompressResponse and Tesla.Middleware.Compression\nCVE ID : CVE-2026-48594\n \n Published : June 2, 2026, 7:08 p.m. | 1\u00a0hour, 16\u00a0minutes ago\n \n Description : Improper Handling of Highly Compressed Data (Data Amplification)...", "creation_timestamp": "2026-06-02T21:29:20.103045Z"}, {"uuid": "20199e6e-43ff-41d6-a986-904ba5b404b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48596", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mndkdilowi2f", "content": "CVE-2026-48596 - CRLF injection in Tesla.Multipart.add_content_type_param/2 allows HTTP header injection\nCVE ID : CVE-2026-48596\n \n Published : June 2, 2026, 7:09 p.m. | 1\u00a0hour, 15\u00a0minutes ago\n \n Description : Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Re...", "creation_timestamp": "2026-06-02T21:34:20.714494Z"}, {"uuid": "fdb0545a-0631-49b3-a1d6-21cdbe8b4641", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48599", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3moejf54fro22", "content": "CVE-2026-48599 - Authorization bypass via path binding override in elixir-grpc/grpc HTTP transcoding\nCVE ID : CVE-2026-48599\n \n Published : June 15, 2026, 11:16 p.m. | 25\u00a0minutes ago\n \n Description : Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc...", "creation_timestamp": "2026-06-16T00:15:13.534327Z"}, {"uuid": "512d7528-5f4a-4d4b-ade0-a049cd075aee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48598", "type": "published-proof-of-concept", "source": "Telegram/zS0m-Smw9tMC2xQZhVRiFtrXmVStzlksgIyfU5bMHDdEXnY", "content": "", "creation_timestamp": "2026-06-09T15:00:06.000000Z"}, {"uuid": "2569e4a8-4755-4027-844a-1bed87a5ae76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48595", "type": "published-proof-of-concept", "source": "Telegram/TPZhP3a04vI9AManDnxQiLM92frB40hJI3gtpEixtxo5IZo", "content": "", "creation_timestamp": "2026-06-09T15:00:12.000000Z"}, {"uuid": "f02be47b-1e7f-429a-bfc1-78bf38903ed4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48595", "type": "published-proof-of-concept", "source": "Telegram/MkZ_OGQrZR4dMhKDK0OVbcEjJF0IE8jmF8NR0mdJeKW4f6Q", "content": "", "creation_timestamp": "2026-06-06T11:00:14.000000Z"}, {"uuid": "498a8644-7036-4024-bca2-3e5d5e3b42eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48593", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-6xh2-93p9-vqh4", "content": "", "creation_timestamp": "2026-07-01T02:50:21.224858Z"}, {"uuid": "59a29974-98c7-45c5-bb18-d89c82bf8483", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48592", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-389x-rgxr-8m33", "content": "", "creation_timestamp": "2026-07-01T02:50:18.788719Z"}, {"uuid": "459e27ca-dd5a-4ef3-8dff-213b8315808e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48598", "type": "seen", "source": "https://gist.github.com/alon710/5cf8fa01fdabad32641db4fb6525028d", "content": "# CVE-2026-48598: CVE-2026-48598: Multipart Part Header Injection and Request Smuggling in elixir-tesla\n\n> **CVSS Score:** 2.1\n> **Published:** 2026-07-10\n> **Full Report:** https://cvereports.com/reports/CVE-2026-48598\n\n## Summary\nAn Improper Encoding or Escaping of Output vulnerability (CWE-116) in elixir-tesla allowed unauthenticated remote code execution or request smuggling via unescaped Content-Disposition parameters in multipart form-data requests.\n\n## TL;DR\nUnescaped carriage returns, line feeds, and double-quotes in elixir-tesla's multipart module allow multipart header injection and request smuggling.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-116\n- **Attack Vector**: Local\n- **CVSS v4.0 Score**: 2.1 (Low)\n- **EPSS Score**: 0.00143\n- **Impact**: Low Subsequent System Integrity\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- elixir-tesla\n- **tesla**: >= 0.8.0, < 1.18.3 (Fixed in: `1.18.3`)\n\n## Mitigation\n\n- Upgrade the elixir-tesla dependency to version 1.18.3 or newer\n- Filter user-controlled input values to remove carriage returns, line feeds, and double-quote characters before parsing\n- Wrap dynamic multipart compilation steps in exception-handling blocks to prevent application crashes\n\n**Remediation Steps:**\n1. Open your mix.exs configuration file\n2. Locate the {:tesla, \"...\"} dependency line and update the version requirement to >= 1.18.3\n3. Execute mix deps.get to fetch the patched version of the package\n4. Run your test suite to verify no uncaught ArgumentError exceptions occur during multipart serialization\n\n## References\n\n- [CVE-2026-48598 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-48598)\n- [GHSA-28jh-g32x-v9v4 Advisory on GitHub](https://github.com/elixir-tesla/tesla/security/advisories/GHSA-28jh-g32x-v9v4)\n- [Erlang Ecosystem Foundation CNA Advisory](https://cna.erlef.org/cves/CVE-2026-48598.html)\n- [OSV Registry Record for CVE-2026-48598](https://osv.dev/vulnerability/EEF-CVE-2026-48598)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-48598) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-10T00:42:13.295577Z"}, {"uuid": "c802894e-802b-4a12-aa18-46a13e92a91e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48597", "type": "seen", "source": "https://gist.github.com/alon710/c57bf8187a7fb4d8c5e9247f7948a17b", "content": "# CVE-2026-48597: CVE-2026-48597: Denial of Service via Atom Table Exhaustion in Elixir Tesla Client (Mint Adapter)\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-07-10\n> **Full Report:** https://cvereports.com/reports/CVE-2026-48597\n\n## Summary\nCVE-2026-48597 is a high-severity Denial of Service (DoS) vulnerability in the Elixir HTTP client library Tesla (specifically involving the Mint adapter) that allows an unauthenticated remote attacker to cause an unrecoverable crash of the Erlang Virtual Machine (BEAM). The flaw arises from the dynamic conversion of untrusted URL schemes into Erlang atoms without validation, leading to global atom table exhaustion.\n\n## TL;DR\nA high-severity Denial of Service vulnerability in the Elixir Tesla HTTP client (using the Mint adapter) allows remote, unauthenticated attackers to crash the Erlang VM by submitting arbitrary URL schemes that exhaust the non-garbage-collected atom table.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-770\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 8.2 (High)\n- **EPSS Score**: 0.00301 (0.30%)\n- **Exploit Status**: Proof of Concept (poc)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- elixir-tesla (tesla Hex package)\n- **tesla**: >= 1.3.0, < 1.18.3 (Fixed in: `1.18.3`)\n\n## Mitigation\n\n- Upgrade the tesla library to version 1.18.3 or later to enforce scheme allow-listing.\n- Validate and sanitize user-supplied URLs before passing them to the Tesla client to ensure they only contain approved scheme strings like 'http' or 'https'.\n- Disable the automatic following of redirects when interacting with untrusted hosts, or intercept redirect URLs to filter out unexpected schemes.\n- Switch to an alternative HTTP adapter (such as Hackney or Finch) that does not convert dynamic request metadata into atoms.\n\n**Remediation Steps:**\n1. Open your Elixir project's mix.exs file.\n2. Locate the {:tesla, ...} dependency definition.\n3. Update the version constraint to '~> 1.18.3' or higher.\n4. Run 'mix deps.update tesla' in your terminal to fetch and compile the patched version.\n5. Deploy the updated application to production and monitor the VM's atom table count to verify stability.\n\n## References\n\n- [GitHub Security Advisory GHSA-h74c-q9j7-mpcm](https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm)\n- [Fix Commit on GitHub](https://github.com/elixir-tesla/tesla/commit/4699c3cb3e2fd6078f99f45f11cf7466aeedbf0e)\n- [Erlang Ecosystem Foundation Advisory](https://cna.erlef.org/cves/CVE-2026-48597.html)\n- [OSV Ecosystem Advisory Record](https://osv.dev/vulnerability/EEF-CVE-2026-48597)\n- [CVE.org Official Record](https://www.cve.org/CVERecord?id=CVE-2026-48597)\n- [NVD Vulnerability Details](https://nvd.nist.gov/vuln/detail/CVE-2026-48597)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-48597) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-10T01:12:43.592256Z"}, {"uuid": "80d2327d-377f-461b-85ac-b6917b7aea7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48595", "type": "seen", "source": "https://gist.github.com/alon710/34fe998f34bdbbf866bd428a21589671", "content": "# CVE-2026-48595: CVE-2026-48595: Cross-Origin Credential Leakage in Elixir Tesla Client via Case-Sensitive Redirect Filter Bypass\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-07-10\n> **Full Report:** https://cvereports.com/reports/CVE-2026-48595\n\n## Summary\nA high-severity security vulnerability in Elixir's Tesla HTTP client library (CVE-2026-48595) allows unauthenticated remote attackers to harvest sensitive credentials, including Authorization headers and cookies. The flaw resides in the 'Tesla.Middleware.FollowRedirects' component, which performs case-sensitive lookups when stripping credentials during cross-origin redirects. Because HTTP headers are case-insensitive by RFC specifications, standard canonical casing (e.g., 'Authorization') bypasses the lowercase-only blocklist, leaking tokens to untrusted external redirect destinations.\n\n## TL;DR\nCase-sensitive header filtering in Tesla's FollowRedirects middleware fails to strip credentials like 'Authorization' during cross-origin redirects if they contain uppercase characters, leading to token leakage to untrusted hosts.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-178\n- **Attack Vector**: Network (Remote)\n- **CVSS v4 Score**: 8.2 (High)\n- **EPSS Score**: 0.00396 (0.40%)\n- **Exploit Status**: Proof of Concept (PoC) Publicly Available\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Elixir systems integrating the elixir-tesla/tesla library with active follow-redirect modules.\n- **tesla**: >= 1.4.0, < 1.18.3 (Fixed in: `1.18.3`)\n\n## Mitigation\n\n- Upgrade the elixir-tesla/tesla dependency to version 1.18.3 or greater.\n- Normalize all outgoing HTTP header keys to lowercase at the application layer prior to dispatching requests.\n- Sanitize client-provided redirection inputs to avoid cross-origin redirection routes.\n\n**Remediation Steps:**\n1. Open your project's mix.exs configuration file.\n2. Locate the {:tesla, ...} dependency definition.\n3. Modify the version constraint to requiring '~> 1.18.3' or greater.\n4. Execute 'mix deps.get' in your shell to fetch the updated packages.\n5. Rebuild and run tests to ensure no regression occurs.\n\n## References\n\n- [GitHub Security Advisory - GHSA-9m9w-gxf7-rh8m](https://github.com/elixir-tesla/tesla/security/advisories/GHSA-9m9w-gxf7-rh8m)\n- [CNA EEF Advisory Record](https://cna.erlef.org/cves/CVE-2026-48595.html)\n- [OSV Entry](https://osv.dev/vulnerability/EEF-CVE-2026-48595)\n- [CVE.org Record Database](https://www.cve.org/CVERecord?id=CVE-2026-48595)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-48595) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-10T01:41:47.998773Z"}, {"uuid": "68072a44-577a-4dbb-a687-2d0ec520c1cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48594", "type": "seen", "source": "https://gist.github.com/alon710/771904cdd1d35750b64c7a038f4ce112", "content": "# CVE-2026-48594: CVE-2026-48594: Decompression Bomb Denial of Service in Elixir Tesla HTTP Client\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-07-10\n> **Full Report:** https://cvereports.com/reports/CVE-2026-48594\n\n## Summary\nAn improper handling of highly compressed data (decompression bomb) vulnerability exists in the Elixir Tesla HTTP client when utilizing response decompression middlewares. By serving highly compressed responses or stacked content-encoding headers, a malicious server can cause arbitrary heap exhaustion, leading to a denial of service (DoS) crash in the BEAM virtual machine.\n\n## TL;DR\nUnrestricted decompression and recursive codec handling in Tesla's decompression middleware allow remote servers to trigger heap exhaustion and BEAM VM crashes via tiny, highly compressed response payloads.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-409\n- **Attack Vector**: Network\n- **CVSS Score**: 8.2 (High)\n- **EPSS Score**: 0.00329 (Percentile: 24.87%)\n- **Impact**: Denial of Service (OOM Crash)\n- **Exploit Status**: Theoretical / Patch Analysis\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Elixir Applications deploying Tesla client pipelines with DecompressResponse or Compression middleware active.\n- **tesla**: >= 0.6.0, < 1.18.3 (Fixed in: `1.18.3`)\n\n## Mitigation\n\n- Upgrade Tesla dependency to 1.18.3 or higher.\n- Enforce mandatory :max_body_size limits in middleware options.\n- Avoid handling decompression of external data with unconstrained endpoints.\n- Deploy network-level HTTP header filtering to drop stacked Content-Encodings.\n\n**Remediation Steps:**\n1. Open your project mix.exs file and locate the :tesla dependency.\n2. Update the version constraint to {:tesla, \"~> 1.18.3\"} or higher.\n3. Run mix deps.get to download and lock the updated version.\n4. Locate modules utilizing Tesla.Middleware.DecompressResponse or Tesla.Middleware.Compression.\n5. Append max_body_size:  configuration parameter.\n6. Re-compile and run test suites to ensure integration compatibility.\n\n## References\n\n- [GitHub Advisory GHSA-mc85-72gr-vm9f](https://github.com/elixir-tesla/tesla/security/advisories/GHSA-mc85-72gr-vm9f)\n- [Official Fix Commit](https://github.com/elixir-tesla/tesla/commit/340f75b5d191dc747ef7ac6365bd002d1cd55a9d)\n- [CVE-2026-48594 Record](https://www.cve.org/CVERecord?id=CVE-2026-48594)\n- [NVD CVE-2026-48594 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-48594)\n- [EEF/CNA Advisory Portal](https://cna.erlef.org/cves/CVE-2026-48594.html)\n- [OSV Entry for EEF-CVE-2026-48594](https://osv.dev/vulnerability/EEF-CVE-2026-48594)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-48594) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-10T02:12:08.091772Z"}, {"uuid": "67d24b1a-6ce4-4822-a695-a7c1e84b091e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48598", "type": "published-proof-of-concept", "source": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-28jh-g32x-v9v4", "content": "", "creation_timestamp": "2026-07-10T02:35:03.650983Z"}, {"uuid": "1f84357d-02eb-4ada-9281-3de1d15ceb64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48597", "type": "published-proof-of-concept", "source": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-h74c-q9j7-mpcm", "content": "", "creation_timestamp": "2026-07-10T02:35:05.931939Z"}, {"uuid": "b8566816-2aef-49ae-b52b-116172ae69a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48595", "type": "published-proof-of-concept", "source": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-9m9w-gxf7-rh8m", "content": "", "creation_timestamp": "2026-07-10T02:35:08.163163Z"}, {"uuid": "1ee962a2-bddc-47ac-aeae-e81b5a5aa976", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48594", "type": "published-proof-of-concept", "source": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-mc85-72gr-vm9f", "content": "", "creation_timestamp": "2026-07-10T02:35:10.408608Z"}, {"uuid": "4293cffc-b3e3-4273-87bf-e6e70407b30b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48596", "type": "published-proof-of-concept", "source": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w", "content": "", "creation_timestamp": "2026-07-10T02:35:12.655745Z"}, {"uuid": "74992f22-4473-4b13-baaf-4af5f2077654", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48596", "type": "seen", "source": "https://gist.github.com/alon710/c858490dcced6d8c05b3d0f0cec528f1", "content": "# CVE-2026-48596: CVE-2026-48596: Improper Neutralization of CRLF Sequences in Elixir Tesla Multipart HTTP Client\n\n> **CVSS Score:** 2.1\n> **Published:** 2026-07-10\n> **Full Report:** https://cvereports.com/reports/CVE-2026-48596\n\n## Summary\nCVE-2026-48596 is an Improper Neutralization of CRLF Sequences in HTTP Headers (HTTP Request/Response Splitting, CWE-113) in the Elixir Tesla HTTP client. The flaw resides in how multipart content-type parameters are joined and serialized, enabling attackers to inject arbitrary headers or split HTTP requests when applications pass untrusted inputs to the parameters of multipart uploads.\n\n## TL;DR\nAn HTTP request/response splitting vulnerability in elixir-tesla allowed unauthenticated remote attackers to inject arbitrary headers or perform HTTP request smuggling by supplying CRLF characters to the Tesla.Multipart.add_content_type_param/2 function.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-113 (Improper Neutralization of CRLF Sequences)\n- **Attack Vector**: Local/Remote via application integration pattern\n- **CVSS v4.0 Score**: 2.1 (Low)\n- **EPSS Score**: 0.0017 (Percentile: 6.66%)\n- **Impact**: HTTP Request Splitting and Header Injection\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Elixir applications utilizing the elixir-tesla HTTP client library with user-provided parameters forwarded directly to the multipart boundary or charset configuration APIs.\n- **tesla**: from 0.8.0 before 1.18.3 (Fixed in: `1.18.3`)\n\n## Mitigation\n\n- Upgrade to version 1.18.3 or higher of the tesla hex package.\n- Sanitize user-provided values passed to add_content_type_param/2 by explicitly stripping or rejecting carriage returns, line feeds, and semicolons.\n- Implement static analysis checks to detect unvalidated parameters passing from entry-points into Tesla Multipart constructs.\n\n**Remediation Steps:**\n1. Open your application's `mix.exs` configuration file.\n2. Locate the `tesla` dependency declaration in the `deps/0` list.\n3. Update the version constraint to `{:tesla, \"~> 1.18.3\"}`.\n4. Run `mix deps.update tesla` to download and lock the secured package version.\n5. Run `mix test` to confirm that standard multipart behavior remains functional.\n\n## References\n\n- [GitHub Security Advisory GHSA-q7jx-v53g-848w](https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w)\n- [Fix Commit](https://github.com/elixir-tesla/tesla/commit/23601edac5d22ba9407b427967b5bdbda201aec2)\n- [Erlang Ecosystem Foundation Advisory details](https://cna.erlef.org/cves/CVE-2026-48596.html)\n- [OSV Database Record](https://osv.dev/vulnerability/EEF-CVE-2026-48596)\n- [NVD Vulnerability Record](https://nvd.nist.gov/vuln/detail/CVE-2026-48596)\n- [CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-48596)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-48596) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-10T02:42:38.354642Z"}]}