FKIE_CVE-2026-49756

Vulnerability from fkie_nvd - Published: 2026-06-08 16:16 - Updated: 2026-08-18 19:15
Severity
3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Summary
Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in wojtekmach Req allows multipart parameter smuggling via attacker-influenced part metadata. Req.Utils.encode_form_part/2 in lib/req/utils.ex builds the per-part headers by interpolating the caller-supplied name, filename, and content_type values directly into the content-disposition and content-type lines with no escaping or CRLF stripping. A value containing ", \r, or \n closes the surrounding quoted value and starts a new header line; an additional \r\n--<boundary> terminates the current part and prepends a smuggled part of the attacker's choosing. This is reachable through every supported way of supplying a part. It is particularly easy when value is a %File.Stream{}, because filename then defaults to Path.basename(stream.path) and POSIX filenames may legitimately contain \r and \n. Any application that forwards user-controlled filenames (or field names / MIME types) through Req.post/2 with form_multipart: lets an attacker inject arbitrary headers into the outgoing multipart body or smuggle additional fields and parts into the request the victim service sends downstream. This issue affects req: from 0.5.3 before 0.6.0.
References
6b3ad84c-e1a6-4bf7-a703-f496b71e49dbhttps://cna.erlef.org/cves/CVE-2026-49756.htmlThird Party Advisory, Mitigation
6b3ad84c-e1a6-4bf7-a703-f496b71e49dbhttps://github.com/wojtekmach/req/commit/74506ff2c5addf74df85d79dc726e9b2e264a8baPatch
6b3ad84c-e1a6-4bf7-a703-f496b71e49dbhttps://github.com/wojtekmach/req/security/advisories/GHSA-px9f-whj3-246mVendor Advisory
6b3ad84c-e1a6-4bf7-a703-f496b71e49dbhttps://osv.dev/vulnerability/EEF-CVE-2026-49756Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0https://github.com/wojtekmach/req/security/advisories/GHSA-px9f-whj3-246mVendor Advisory
Impacted products
Vendor Product Version
wojtekmach req *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:wojtekmach:req:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Req.Utils\u0027"
          ],
          "packageName": "req",
          "packageURL": "pkg:hex/req",
          "product": "req",
          "programFiles": [
            "lib/req/utils.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Req.Utils\u0027:encode_form_part/2"
            }
          ],
          "repo": "https://github.com/wojtekmach/req",
          "vendor": "wojtekmach",
          "versions": [
            {
              "lessThan": "0.6.0",
              "status": "affected",
              "version": "0.5.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:wojtekmach:req:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Req.Utils\u0027"
          ],
          "packageName": "wojtekmach/req",
          "packageURL": "pkg:github/wojtekmach/req",
          "product": "req",
          "programFiles": [
            "lib/req/utils.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Req.Utils\u0027:encode_form_part/2"
            }
          ],
          "repo": "https://github.com/wojtekmach/req.git",
          "vendor": "wojtekmach",
          "versions": [
            {
              "lessThan": "74506ff2c5addf74df85d79dc726e9b2e264a8ba",
              "status": "affected",
              "version": "60253dbe9436cb8e9c738f895032f2e87939b597",
              "versionType": "git"
            }
          ]
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wojtekmach:req:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E3441D9F-1ACB-44AD-905C-F62F2A15C275",
              "versionEndExcluding": "0.6.0",
              "versionStartIncluding": "0.5.3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027) vulnerability in wojtekmach Req allows multipart parameter smuggling via attacker-influenced part metadata.\n\nReq.Utils.encode_form_part/2 in lib/req/utils.ex builds the per-part headers by interpolating the caller-supplied name, filename, and content_type values directly into the content-disposition and content-type lines with no escaping or CRLF stripping. A value containing \", \\r, or \\n closes the surrounding quoted value and starts a new header line; an additional \\r\\n--\u003cboundary\u003e terminates the current part and prepends a smuggled part of the attacker\u0027s choosing.\n\nThis is reachable through every supported way of supplying a part. It is particularly easy when value is a %File.Stream{}, because filename then defaults to Path.basename(stream.path) and POSIX filenames may legitimately contain \\r and \\n. Any application that forwards user-controlled filenames (or field names / MIME types) through Req.post/2 with form_multipart: lets an attacker inject arbitrary headers into the outgoing multipart body or smuggle additional fields and parts into the request the victim service sends downstream.\n\nThis issue affects req: from 0.5.3 before 0.6.0."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de Neutralizaci\u00f3n Incorrecta de Secuencias CRLF (\u0027Inyecci\u00f3n CRLF\u0027) en wojtekmach Req permite el contrabando de par\u00e1metros multipart a trav\u00e9s de metadatos de parte influenciados por el atacante.\n\nReq.Utils.encode_form_part/2 en lib/req/utils.ex construye los encabezados por parte interpolando los valores de nombre, nombre de archivo y tipo de contenido suministrados por el llamador directamente en las l\u00edneas de content-disposition y content-type sin escape ni eliminaci\u00f3n de CRLF. Un valor que contiene \", \\r, o \\n cierra el valor entre comillas circundante y comienza una nueva l\u00ednea de encabezado; un \\r\\n--\u003cboundary\u003e adicional termina la parte actual y antepone una parte contrabandeada a elecci\u00f3n del atacante.\n\nEsto es alcanzable a trav\u00e9s de cada forma compatible de suministrar una parte. Es particularmente f\u00e1cil cuando el valor es un %File.Stream{}, porque el nombre de archivo por defecto es Path.basename(stream.path) y los nombres de archivo POSIX pueden contener leg\u00edtimamente \\r y \\n. Cualquier aplicaci\u00f3n que reenv\u00ede nombres de archivo controlados por el usuario (o nombres de campo / tipos MIME) a trav\u00e9s de Req.post/2 con form_multipart: permite a un atacante inyectar encabezados arbitrarios en el cuerpo multipart saliente o contrabandear campos y partes adicionales en la solicitud que el servicio v\u00edctima env\u00eda aguas abajo.\n\nEste problema afecta a req: desde 0.5.3 antes de 0.6.0."
    }
  ],
  "id": "CVE-2026-49756",
  "lastModified": "2026-08-18T19:15:38.860",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "LOCAL",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 2.1,
          "baseSeverity": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "LOW",
          "subIntegrityImpact": "LOW",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-49756",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-08T16:05:54.070488Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-08T16:16:44.040",
  "references": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Third Party Advisory",
        "Mitigation"
      ],
      "url": "https://cna.erlef.org/cves/CVE-2026-49756.html"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/wojtekmach/req/commit/74506ff2c5addf74df85d79dc726e9b2e264a8ba"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/wojtekmach/req/security/advisories/GHSA-px9f-whj3-246m"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-49756"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/wojtekmach/req/security/advisories/GHSA-px9f-whj3-246m"
    }
  ],
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-93"
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.