CVE-2026-48596

216.73.217.80

· Published 02/06/2026 20:16 · Modified 03/06/2026 14:16

Labels: CVE-2026-48596 2026-06-02 6b3ad84c-e1a6-4bf7-a703-f496b71e49db CVE-2026-48596 CWE-113

Essential information

Published: 02/06/2026 20:16
Modified: 03/06/2026 14:16
Author: —
Creator: —
CVSS: 2.1 LOW (v3) 2.1 LOW (v4.0)
CISA KEV: No
CWE: —
CVSS vector: —

CVSS metrics

Description

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2. Tesla.Multipart.add_content_type_param/2 appends caller-supplied strings to the multipart content_type_params list without validating for CR (\r) or LF (\n) characters. Tesla.Multipart.headers/1 then joins these params verbatim with "; " to construct the outgoing Content-Type header value. A param containing \r\n splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into add_content_type_param/2 is affected. This issue affects tesla: from 0.8.0 before 1.18.3.

NVD status

Status: Received — CVE has been recently published to the CVE List and has been received by the NVD.
Source: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
NVD: View on NVD

Affected products (CPE)

Product	CPE
elixir-tesla / tesla	`cpe:2.3:a:elixir-tesla:tesla:0.8.0-1.18.3:::::::*`