CVE Feed

    Dashboard / CVE / CVE-2026-48596

    CVE-2026-48596

    Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2. Tesla.Multipart.add_content_type_param/2 appends caller-supplied strings to the multipart content_type_params list without validating for CR (\r) or LF (\n) characters. Tesla.Multipart.headers/1 then joins these params verbatim with "; " to construct the outgoing Content-Type header value. A param containing \r\n splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into add_content_type_param/2 is affected. This issue affects tesla: from 0.8.0 before 1.18.3.

    Published:Jun 2, 2026
    Last Modified:Aug 19, 2026
    EPS:Jun 2, 2026
    EPSS Score:0.00187
    CVSS Score:3.7

    Affected Products

    Vendor
    Elixir-tesla
    Product
    Tesla

    Exploits

    https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848whttps://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High