Vulnerability-Lookup

CVE-2026-48596 (GCVE-0-2026-48596)

Vulnerability from cvelistv5 – Published: 2026-06-02 19:09 – Updated: 2026-09-24 20:53

Title

CRLF injection in Tesla.Multipart.add_content_type_param/2 allows HTTP header injection

Summary

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2. Tesla.Multipart.add_content_type_param/2 appends caller-supplied strings to the multipart content_type_params list without validating for CR (\r) or LF (\n) characters. Tesla.Multipart.headers/1 then joins these params verbatim with "; " to construct the outgoing Content-Type header value. A param containing \r\n splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into add_content_type_param/2 is affected. This issue affects tesla: from 0.8.0 before 1.18.3.

Severity

2.1 (Low)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-03 13:01 UTC

CWE

CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

Assigner

EEF CNA under the mitre root

CNA scorecard A 97/100 over 347 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/elixir-tesla/tesla/security/ad…	vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-48596.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-48596	related
https://github.com/elixir-tesla/tesla/commit/6ebf…	related
https://github.com/elixir-tesla/tesla/commit/2360…	patch

Impacted products

2 products

Vendor	Product	Version	CPE status
elixir-tesla	tesla	Affected: 0.8.0 , < 1.18.3 (semver) cpe:2.3:a:elixir-tesla:tesla::::::::
elixir-tesla	tesla	Affected: 6ebfdb9abe9c6f119408045b933d82462decd351 , < 23601edac5d22ba9407b427967b5bdbda201aec2 (git) cpe:2.3:a:elixir-tesla:tesla::::::::

Date Public

2026-06-02 19:09

Credits

Peter Ullrich Yordis Prieto Jonatan Männchen / EEF

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48596",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-03T13:01:48.568462Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-03T13:01:52.596Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Tesla.Multipart\u0027"
          ],
          "packageName": "tesla",
          "packageURL": "pkg:hex/tesla",
          "product": "tesla",
          "programFiles": [
            "lib/tesla/multipart.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Tesla.Multipart\u0027:add_content_type_param/2"
            },
            {
              "name": "\u0027Elixir.Tesla.Multipart\u0027:headers/1"
            }
          ],
          "repo": "https://github.com/elixir-tesla/tesla",
          "vendor": "elixir-tesla",
          "versions": [
            {
              "lessThan": "1.18.3",
              "status": "affected",
              "version": "0.8.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Tesla.Multipart\u0027"
          ],
          "packageName": "elixir-tesla/tesla",
          "packageURL": "pkg:github/elixir-tesla/tesla",
          "product": "tesla",
          "programFiles": [
            "lib/tesla/multipart.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Tesla.Multipart\u0027:add_content_type_param/2"
            },
            {
              "name": "\u0027Elixir.Tesla.Multipart\u0027:headers/1"
            }
          ],
          "repo": "https://github.com/elixir-tesla/tesla",
          "vendor": "elixir-tesla",
          "versions": [
            {
              "lessThan": "23601edac5d22ba9407b427967b5bdbda201aec2",
              "status": "affected",
              "version": "6ebfdb9abe9c6f119408045b933d82462decd351",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe application must pass untrusted input into \u003ccode\u003eTesla.Multipart.add_content_type_param/2\u003c/code\u003e.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "The application must pass untrusted input into `Tesla.Multipart.add_content_type_param/2`."
            }
          ],
          "value": "The application must pass untrusted input into Tesla.Multipart.add_content_type_param/2."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.18.3",
                  "versionStartIncluding": "0.8.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Yordis Prieto"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "datePublic": "2026-06-02T19:09:31.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027) vulnerability in elixir-tesla tesla allows HTTP header injection via \u003ccode\u003eTesla.Multipart.add_content_type_param/2\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eTesla.Multipart.add_content_type_param/2\u003c/code\u003e appends caller-supplied strings to the multipart \u003ccode\u003econtent_type_params\u003c/code\u003e list without validating for CR (\u003ccode\u003e\\r\u003c/code\u003e) or LF (\u003ccode\u003e\\n\u003c/code\u003e) characters. \u003ccode\u003eTesla.Multipart.headers/1\u003c/code\u003e then joins these params verbatim with \u003ccode\u003e\"; \"\u003c/code\u003e to construct the outgoing \u003ccode\u003eContent-Type\u003c/code\u003e header value. A param containing \u003ccode\u003e\\r\\n\u003c/code\u003e splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into \u003ccode\u003eadd_content_type_param/2\u003c/code\u003e is affected.\u003c/p\u003e\n\u003cp\u003eThis issue affects tesla: from 0.8.0 before 1.18.3.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027) vulnerability in elixir-tesla tesla allows HTTP header injection via `Tesla.Multipart.add_content_type_param/2`.\n\n`Tesla.Multipart.add_content_type_param/2` appends caller-supplied strings to the multipart `content_type_params` list without validating for CR (`\\r`) or LF (`\\n`) characters. `Tesla.Multipart.headers/1` then joins these params verbatim with `\"; \"` to construct the outgoing `Content-Type` header value. A param containing `\\r\\n` splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into `add_content_type_param/2` is affected.\n\nThis issue affects tesla: from 0.8.0 before 1.18.3."
            }
          ],
          "value": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027) vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_type_param/2 appends caller-supplied strings to the multipart content_type_params list without validating for CR (\\r) or LF (\\n) characters. Tesla.Multipart.headers/1 then joins these params verbatim with \"; \" to construct the outgoing Content-Type header value. A param containing \\r\\n splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into add_content_type_param/2 is affected.\n\nThis issue affects tesla: from 0.8.0 before 1.18.3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-105",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-105 HTTP Request Splitting"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-113",
              "description": "CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T20:53:10.649Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w"
        },
        {
          "name": "EEF CNA record for CVE-2026-48596",
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-48596.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-48596",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48596"
        },
        {
          "name": "Introducing commit 6ebfdb9 in elixir-tesla/tesla",
          "tags": [
            "related"
          ],
          "url": "https://github.com/elixir-tesla/tesla/commit/6ebfdb9abe9c6f119408045b933d82462decd351"
        },
        {
          "name": "Fix commit 23601ed in elixir-tesla/tesla",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/elixir-tesla/tesla/commit/23601edac5d22ba9407b427967b5bdbda201aec2"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "CRLF injection in Tesla.Multipart.add_content_type_param/2 allows HTTP header injection",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eValidate content-type parameter strings before passing them to \u003ccode\u003eTesla.Multipart.add_content_type_param/2\u003c/code\u003e, rejecting any value that contains \u003ccode\u003e\\r\u003c/code\u003e or \u003ccode\u003e\\n\u003c/code\u003e.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Validate content-type parameter strings before passing them to `Tesla.Multipart.add_content_type_param/2`, rejecting any value that contains `\\r` or `\\n`."
            }
          ],
          "value": "Validate content-type parameter strings before passing them to Tesla.Multipart.add_content_type_param/2, rejecting any value that contains \\r or \\n."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-48596",
    "datePublished": "2026-06-02T19:09:31.615Z",
    "dateReserved": "2026-05-22T09:36:56.834Z",
    "dateUpdated": "2026-09-24T20:53:10.649Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-48596",
      "date": "2026-11-02",
      "epss": "0.00239",
      "percentile": "0.15028"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://repo.hex.pm",
                "cpes": [
                  "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "modules": [
                  "\u0027Elixir.Tesla.Multipart\u0027"
                ],
                "packageName": "tesla",
                "packageURL": "pkg:hex/tesla",
                "product": "tesla",
                "programFiles": [
                  "lib/tesla/multipart.ex"
                ],
                "programRoutines": [
                  {
                    "name": "\u0027Elixir.Tesla.Multipart\u0027:add_content_type_param/2"
                  },
                  {
                    "name": "\u0027Elixir.Tesla.Multipart\u0027:headers/1"
                  }
                ],
                "repo": "https://github.com/elixir-tesla/tesla",
                "vendor": "elixir-tesla",
                "versions": [
                  {
                    "lessThan": "1.18.3",
                    "status": "affected",
                    "version": "0.8.0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "collectionURL": "https://github.com",
                "cpes": [
                  "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "modules": [
                  "\u0027Elixir.Tesla.Multipart\u0027"
                ],
                "packageName": "elixir-tesla/tesla",
                "packageURL": "pkg:github/elixir-tesla/tesla",
                "product": "tesla",
                "programFiles": [
                  "lib/tesla/multipart.ex"
                ],
                "programRoutines": [
                  {
                    "name": "\u0027Elixir.Tesla.Multipart\u0027:add_content_type_param/2"
                  },
                  {
                    "name": "\u0027Elixir.Tesla.Multipart\u0027:headers/1"
                  }
                ],
                "repo": "https://github.com/elixir-tesla/tesla",
                "vendor": "elixir-tesla",
                "versions": [
                  {
                    "lessThan": "23601edac5d22ba9407b427967b5bdbda201aec2",
                    "status": "affected",
                    "version": "6ebfdb9abe9c6f119408045b933d82462decd351",
                    "versionType": "git"
                  }
                ]
              }
            ],
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "876BFB6A-2010-4450-9EA4-F4AF4B78F93F",
                    "versionEndExcluding": "1.18.3",
                    "versionStartIncluding": "0.8.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027) vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_type_param/2 appends caller-supplied strings to the multipart content_type_params list without validating for CR (\\r) or LF (\\n) characters. Tesla.Multipart.headers/1 then joins these params verbatim with \"; \" to construct the outgoing Content-Type header value. A param containing \\r\\n splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into add_content_type_param/2 is affected.\n\nThis issue affects tesla: from 0.8.0 before 1.18.3."
          },
          {
            "lang": "es",
            "value": "La vulnerabilidad de Neutralizaci\u00f3n Inadecuada de Secuencias CRLF en Encabezados HTTP (\u0027Divisi\u00f3n de Solicitud/Respuesta HTTP\u0027) en elixir-tesla tesla permite la inyecci\u00f3n de encabezados HTTP a trav\u00e9s de Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_type_param/2 a\u00f1ade cadenas proporcionadas por el llamador a la lista multipart content_type_params sin validar los caracteres CR (\\r) o LF (\\n). Tesla.Multipart.headers/1 luego une estos par\u00e1metros textualmente con \u0027; \u0027 para construir el valor del encabezado Content-Type saliente. Un par\u00e1metro que contiene \\r\\n divide la l\u00ednea del encabezado, permitiendo que se inyecten encabezados arbitrarios en la solicitud HTTP saliente. Cualquier aplicaci\u00f3n que reenv\u00ede entrada no confiable (como un charset o una cadena de par\u00e1metro proporcionados por el usuario) a add_content_type_param/2 se ve afectada.\n\nEste problema afecta a tesla: desde 0.8.0 antes de 1.18.3."
          }
        ],
        "id": "CVE-2026-48596",
        "lastModified": "2026-09-24T21:17:13.370",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 3.7,
                "baseSeverity": "LOW",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 1.4,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "LOCAL",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 2.1,
                "baseSeverity": "LOW",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "LOW",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-48596",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-03T13:01:48.568462Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-06-02T20:16:38.557",
        "references": [
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://cna.erlef.org/cves/CVE-2026-48596.html"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "tags": [
              "Broken Link"
            ],
            "url": "https://github.com/elixir-tesla/tesla/commit/23601edac5d22ba9407b427967b5bdbda201aec2"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://github.com/elixir-tesla/tesla/commit/6ebfdb9abe9c6f119408045b933d82462decd351"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "tags": [
              "Exploit",
              "Vendor Advisory"
            ],
            "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48596"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "Exploit",
              "Vendor Advisory"
            ],
            "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w"
          }
        ],
        "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-113"
              }
            ],
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-06-04T10:03:45+00:00",
      "cve": "CVE-2026-48596",
      "id": "CVE-2026-48596",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CRLF injection in Tesla.Multipart.add_content_type_param/2 allows HTTP header injection",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48596.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-48596",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-03T13:01:48.568462Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-03T13:01:27.414Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://repo.hex.pm",
              "cpes": [
                "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "modules": [
                "\u0027Elixir.Tesla.Multipart\u0027"
              ],
              "packageName": "tesla",
              "packageURL": "pkg:hex/tesla",
              "product": "tesla",
              "programFiles": [
                "lib/tesla/multipart.ex"
              ],
              "programRoutines": [
                {
                  "name": "\u0027Elixir.Tesla.Multipart\u0027:add_content_type_param/2"
                },
                {
                  "name": "\u0027Elixir.Tesla.Multipart\u0027:headers/1"
                }
              ],
              "repo": "https://github.com/elixir-tesla/tesla",
              "vendor": "elixir-tesla",
              "versions": [
                {
                  "lessThan": "1.18.3",
                  "status": "affected",
                  "version": "0.8.0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "collectionURL": "https://github.com",
              "cpes": [
                "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "modules": [
                "\u0027Elixir.Tesla.Multipart\u0027"
              ],
              "packageName": "elixir-tesla/tesla",
              "packageURL": "pkg:github/elixir-tesla/tesla",
              "product": "tesla",
              "programFiles": [
                "lib/tesla/multipart.ex"
              ],
              "programRoutines": [
                {
                  "name": "\u0027Elixir.Tesla.Multipart\u0027:add_content_type_param/2"
                },
                {
                  "name": "\u0027Elixir.Tesla.Multipart\u0027:headers/1"
                }
              ],
              "repo": "https://github.com/elixir-tesla/tesla",
              "vendor": "elixir-tesla",
              "versions": [
                {
                  "lessThan": "23601edac5d22ba9407b427967b5bdbda201aec2",
                  "status": "affected",
                  "version": "6ebfdb9abe9c6f119408045b933d82462decd351",
                  "versionType": "git"
                }
              ]
            }
          ],
          "configurations": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eThe application must pass untrusted input into \u003ccode\u003eTesla.Multipart.add_content_type_param/2\u003c/code\u003e.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "The application must pass untrusted input into `Tesla.Multipart.add_content_type_param/2`."
                }
              ],
              "value": "The application must pass untrusted input into Tesla.Multipart.add_content_type_param/2."
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "1.18.3",
                      "versionStartIncluding": "0.8.0",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ],
              "operator": "AND"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Peter Ullrich"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "Yordis Prieto"
            },
            {
              "lang": "en",
              "type": "analyst",
              "value": "Jonatan M\u00e4nnchen / EEF"
            }
          ],
          "datePublic": "2026-06-02T19:09:31.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eImproper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027) vulnerability in elixir-tesla tesla allows HTTP header injection via \u003ccode\u003eTesla.Multipart.add_content_type_param/2\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eTesla.Multipart.add_content_type_param/2\u003c/code\u003e appends caller-supplied strings to the multipart \u003ccode\u003econtent_type_params\u003c/code\u003e list without validating for CR (\u003ccode\u003e\\r\u003c/code\u003e) or LF (\u003ccode\u003e\\n\u003c/code\u003e) characters. \u003ccode\u003eTesla.Multipart.headers/1\u003c/code\u003e then joins these params verbatim with \u003ccode\u003e\"; \"\u003c/code\u003e to construct the outgoing \u003ccode\u003eContent-Type\u003c/code\u003e header value. A param containing \u003ccode\u003e\\r\\n\u003c/code\u003e splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into \u003ccode\u003eadd_content_type_param/2\u003c/code\u003e is affected.\u003c/p\u003e\n\u003cp\u003eThis issue affects tesla: from 0.8.0 before 1.18.3.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027) vulnerability in elixir-tesla tesla allows HTTP header injection via `Tesla.Multipart.add_content_type_param/2`.\n\n`Tesla.Multipart.add_content_type_param/2` appends caller-supplied strings to the multipart `content_type_params` list without validating for CR (`\\r`) or LF (`\\n`) characters. `Tesla.Multipart.headers/1` then joins these params verbatim with `\"; \"` to construct the outgoing `Content-Type` header value. A param containing `\\r\\n` splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into `add_content_type_param/2` is affected.\n\nThis issue affects tesla: from 0.8.0 before 1.18.3."
                }
              ],
              "value": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027) vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_type_param/2 appends caller-supplied strings to the multipart content_type_params list without validating for CR (\\r) or LF (\\n) characters. Tesla.Multipart.headers/1 then joins these params verbatim with \"; \" to construct the outgoing Content-Type header value. A param containing \\r\\n splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into add_content_type_param/2 is affected.\n\nThis issue affects tesla: from 0.8.0 before 1.18.3."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-105",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-105 HTTP Request Splitting"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "LOCAL",
                "baseScore": 2.1,
                "baseSeverity": "LOW",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "LOW",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-113",
                  "description": "CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-24T20:53:10.649Z",
            "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "shortName": "EEF"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory",
                "related"
              ],
              "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w"
            },
            {
              "name": "EEF CNA record for CVE-2026-48596",
              "tags": [
                "related"
              ],
              "url": "https://cna.erlef.org/cves/CVE-2026-48596.html"
            },
            {
              "name": "OSV record EEF-CVE-2026-48596",
              "tags": [
                "related"
              ],
              "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48596"
            },
            {
              "name": "Introducing commit 6ebfdb9 in elixir-tesla/tesla",
              "tags": [
                "related"
              ],
              "url": "https://github.com/elixir-tesla/tesla/commit/6ebfdb9abe9c6f119408045b933d82462decd351"
            },
            {
              "name": "Fix commit 23601ed in elixir-tesla/tesla",
              "tags": [
                "patch"
              ],
              "url": "https://github.com/elixir-tesla/tesla/commit/23601edac5d22ba9407b427967b5bdbda201aec2"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "CRLF injection in Tesla.Multipart.add_content_type_param/2 allows HTTP header injection",
          "workarounds": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eValidate content-type parameter strings before passing them to \u003ccode\u003eTesla.Multipart.add_content_type_param/2\u003c/code\u003e, rejecting any value that contains \u003ccode\u003e\\r\u003c/code\u003e or \u003ccode\u003e\\n\u003c/code\u003e.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "Validate content-type parameter strings before passing them to `Tesla.Multipart.add_content_type_param/2`, rejecting any value that contains `\\r` or `\\n`."
                }
              ],
              "value": "Validate content-type parameter strings before passing them to Tesla.Multipart.add_content_type_param/2, rejecting any value that contains \\r or \\n."
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "assignerShortName": "EEF",
        "cveId": "CVE-2026-48596",
        "datePublished": "2026-06-02T19:09:31.615Z",
        "dateReserved": "2026-05-22T09:36:56.834Z",
        "dateUpdated": "2026-09-24T20:53:10.649Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-48596

Vulnerability from fkie_nvd - Published: 2026-06-02 20:16 - Updated: 2026-09-24 21:17

Severity

3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Summary

References

URL	Tags
6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://cna.erlef.org/cves/CVE-2026-48596.html	Third Party Advisory
6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/elixir-tesla/tesla/commit/23601edac5d22ba9407b427967b5bdbda201aec2	Broken Link
6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/elixir-tesla/tesla/commit/6ebfdb9abe9c6f119408045b933d82462decd351
6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w	Exploit, Vendor Advisory
6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://osv.dev/vulnerability/EEF-CVE-2026-48596	Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	elixir-tesla	tesla	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Tesla.Multipart\u0027"
          ],
          "packageName": "tesla",
          "packageURL": "pkg:hex/tesla",
          "product": "tesla",
          "programFiles": [
            "lib/tesla/multipart.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Tesla.Multipart\u0027:add_content_type_param/2"
            },
            {
              "name": "\u0027Elixir.Tesla.Multipart\u0027:headers/1"
            }
          ],
          "repo": "https://github.com/elixir-tesla/tesla",
          "vendor": "elixir-tesla",
          "versions": [
            {
              "lessThan": "1.18.3",
              "status": "affected",
              "version": "0.8.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Tesla.Multipart\u0027"
          ],
          "packageName": "elixir-tesla/tesla",
          "packageURL": "pkg:github/elixir-tesla/tesla",
          "product": "tesla",
          "programFiles": [
            "lib/tesla/multipart.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Tesla.Multipart\u0027:add_content_type_param/2"
            },
            {
              "name": "\u0027Elixir.Tesla.Multipart\u0027:headers/1"
            }
          ],
          "repo": "https://github.com/elixir-tesla/tesla",
          "vendor": "elixir-tesla",
          "versions": [
            {
              "lessThan": "23601edac5d22ba9407b427967b5bdbda201aec2",
              "status": "affected",
              "version": "6ebfdb9abe9c6f119408045b933d82462decd351",
              "versionType": "git"
            }
          ]
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "876BFB6A-2010-4450-9EA4-F4AF4B78F93F",
              "versionEndExcluding": "1.18.3",
              "versionStartIncluding": "0.8.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027) vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_type_param/2 appends caller-supplied strings to the multipart content_type_params list without validating for CR (\\r) or LF (\\n) characters. Tesla.Multipart.headers/1 then joins these params verbatim with \"; \" to construct the outgoing Content-Type header value. A param containing \\r\\n splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into add_content_type_param/2 is affected.\n\nThis issue affects tesla: from 0.8.0 before 1.18.3."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de Neutralizaci\u00f3n Inadecuada de Secuencias CRLF en Encabezados HTTP (\u0027Divisi\u00f3n de Solicitud/Respuesta HTTP\u0027) en elixir-tesla tesla permite la inyecci\u00f3n de encabezados HTTP a trav\u00e9s de Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_type_param/2 a\u00f1ade cadenas proporcionadas por el llamador a la lista multipart content_type_params sin validar los caracteres CR (\\r) o LF (\\n). Tesla.Multipart.headers/1 luego une estos par\u00e1metros textualmente con \u0027; \u0027 para construir el valor del encabezado Content-Type saliente. Un par\u00e1metro que contiene \\r\\n divide la l\u00ednea del encabezado, permitiendo que se inyecten encabezados arbitrarios en la solicitud HTTP saliente. Cualquier aplicaci\u00f3n que reenv\u00ede entrada no confiable (como un charset o una cadena de par\u00e1metro proporcionados por el usuario) a add_content_type_param/2 se ve afectada.\n\nEste problema afecta a tesla: desde 0.8.0 antes de 1.18.3."
    }
  ],
  "id": "CVE-2026-48596",
  "lastModified": "2026-09-24T21:17:13.370",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "LOCAL",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 2.1,
          "baseSeverity": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "LOW",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-48596",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-03T13:01:48.568462Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-02T20:16:38.557",
  "references": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://cna.erlef.org/cves/CVE-2026-48596.html"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Broken Link"
      ],
      "url": "https://github.com/elixir-tesla/tesla/commit/23601edac5d22ba9407b427967b5bdbda201aec2"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/elixir-tesla/tesla/commit/6ebfdb9abe9c6f119408045b933d82462decd351"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48596"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w"
    }
  ],
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-113"
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary"
    }
  ]
}

GHSA-Q7JX-V53G-848W

Vulnerability from github – Published: 2026-07-10 00:03 – Updated: 2026-07-10 00:03

Summary

Tesla has CRLF injection in request `Content-Type` header via `add_content_type_param`

Details

Summary

Tesla.Multipart.add_content_type_param/2 appends caller-supplied strings to the multipart Content-Type header with no validation. A param value containing \r\n splits the header line, allowing an attacker who controls any content-type parameter (charset, boundary parameter, etc.) to inject arbitrary headers into the outbound HTTP request.

Details

add_content_type_param/2 in lib/tesla/multipart.ex stores the supplied string directly in multipart.content_type_params without any CR/LF check. headers/1 then joins all params with "; " and appends the result verbatim to the Content-Type header value. Because HTTP headers are delimited by \r\n, a param containing that sequence breaks out of the header field and introduces new header lines before the adapter writes the request to the socket.

The precondition is that untrusted input reaches add_content_type_param/2, which is the normal pattern for applications that accept user-supplied charset values, file type parameters, or any other content-type extension fields.

PoC

Call Tesla.Multipart.add_content_type_param/2 with a value containing \r\nX-Injected: pwned.
Pass the resulting Multipart struct as the request body via any Tesla adapter.
The raw request on the wire contains X-Injected: pwned as a standalone header line.

Impact

Low severity (CVSS v4.0: 2.1). Any application using tesla 0.8.0 through 1.18.2 that passes untrusted input into Tesla.Multipart.add_content_type_param/2 is affected. Consequences range from forging arbitrary outbound request headers to potential request smuggling against the upstream server. Fixed in tesla 1.18.3.

Workarounds

Validate content-type parameter strings before passing them to Tesla.Multipart.add_content_type_param/2, rejecting any value that contains \r or \n.

Reesources

Introduction commit: https://github.com/elixir-tesla/tesla/commit/6ebfdb9abe9c6f119408045b933d82462decd351
Patch commit: https://github.com/elixir-tesla/tesla/commit/23601edac5d22ba9407b427967b5bdbda201aec2

Severity

2.1 (Low)


                  
                    CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Hex",
        "name": "tesla"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.8.0"
            },
            {
              "fixed": "1.18.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-48596"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-113",
      "CWE-93"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-10T00:03:12Z",
    "nvd_published_at": "2026-06-02T20:16:38Z",
    "severity": "LOW"
  },
  "details": "### Summary\n\n`Tesla.Multipart.add_content_type_param/2` appends caller-supplied strings to the multipart `Content-Type` header with no validation. A param value containing `\\r\\n` splits the header line, allowing an attacker who controls any content-type parameter (charset, boundary parameter, etc.) to inject arbitrary headers into the outbound HTTP request.\n\n### Details\n\n`add_content_type_param/2` in `lib/tesla/multipart.ex` stores the supplied string directly in `multipart.content_type_params` without any CR/LF check. `headers/1` then joins all params with `\"; \"` and appends the result verbatim to the `Content-Type` header value. Because HTTP headers are delimited by `\\r\\n`, a param containing that sequence breaks out of the header field and introduces new header lines before the adapter writes the request to the socket.\n\nThe precondition is that untrusted input reaches `add_content_type_param/2`, which is the normal pattern for applications that accept user-supplied charset values, file type parameters, or any other content-type extension fields.\n\n### PoC\n\n1. Call `Tesla.Multipart.add_content_type_param/2` with a value containing `\\r\\nX-Injected: pwned`.\n2. Pass the resulting `Multipart` struct as the request body via any Tesla adapter.\n3. The raw request on the wire contains `X-Injected: pwned` as a standalone header line.\n\n### Impact\n\nLow severity (CVSS v4.0: 2.1). Any application using `tesla` 0.8.0 through 1.18.2 that passes untrusted input into `Tesla.Multipart.add_content_type_param/2` is affected. Consequences range from forging arbitrary outbound request headers to potential request smuggling against the upstream server. Fixed in tesla 1.18.3.\n\n### Workarounds\n\nValidate content-type parameter strings before passing them to `Tesla.Multipart.add_content_type_param/2`, rejecting any value that contains `\\r` or `\\n`.\n\n### Reesources\n\n* Introduction commit: https://github.com/elixir-tesla/tesla/commit/6ebfdb9abe9c6f119408045b933d82462decd351\n* Patch commit: https://github.com/elixir-tesla/tesla/commit/23601edac5d22ba9407b427967b5bdbda201aec2",
  "id": "GHSA-q7jx-v53g-848w",
  "modified": "2026-07-10T00:03:12Z",
  "published": "2026-07-10T00:03:12Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48596"
    },
    {
      "type": "WEB",
      "url": "https://github.com/elixir-tesla/tesla/commit/23601edac5d22ba9407b427967b5bdbda201aec2"
    },
    {
      "type": "WEB",
      "url": "https://cna.erlef.org/cves/CVE-2026-48596.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/elixir-tesla/tesla"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48596"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Tesla has CRLF injection in request `Content-Type` header via `add_content_type_param`"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-48596 (GCVE-0-2026-48596)

FKIE_CVE-2026-48596

GHSA-Q7JX-V53G-848W

Summary

Details

PoC

Impact

Workarounds

Reesources

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour