CVE-2026-48596

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2. Tesla.Multipart.add_content_type_param/2 appends caller-supplied strings to the multipart content_type_params list without validating for CR (\r) or LF (\n) characters. Tesla.Multipart.headers/1 then joins these params verbatim with "; " to construct the outgoing Content-Type header value. A param containing \r\n splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into add_content_type_param/2 is affected. This issue affects tesla: from 0.8.0 before 1.18.3.

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://cna.erlef.org/cves/CVE-2026-48596.html	Third Party Advisory
https://github.com/elixir-tesla/tesla/commit/23601edac5d22ba9407b427967b5bdbda201aec2	Broken Link
https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w	Exploit Vendor Advisory
https://osv.dev/vulnerability/EEF-CVE-2026-48596	Third Party Advisory
https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-06-02 20:16

Updated : 2026-08-19 14:08

NVD link : CVE-2026-48596

Mitre link : CVE-2026-48596

CVE.ORG link : CVE-2026-48596

JSON object : View

Products Affected

elixir-tesla

tesla

CWE

CWE-113

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

{"id": "CVE-2026-48596", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48596", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-03T13:01:48.568462Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.2}], "cvssMetricV40": [{"type": "Secondary", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.1, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "affectedData": [{"cpes": ["cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"], "repo": "https://github.com/elixir-tesla/tesla", "vendor": "elixir-tesla", "modules": ["'Elixir.Tesla.Multipart'"], "product": "tesla", "versions": [{"status": "affected", "version": "0.8.0", "lessThan": "1.18.3", "versionType": "semver"}], "packageURL": "pkg:hex/tesla", "packageName": "tesla", "programFiles": ["lib/tesla/multipart.ex"], "collectionURL": "https://repo.hex.pm", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Tesla.Multipart':add_content_type_param/2"}, {"name": "'Elixir.Tesla.Multipart':headers/1"}]}, {"cpes": ["cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"], "repo": "https://github.com/elixir-tesla/tesla.git", "vendor": "elixir-tesla", "modules": ["'Elixir.Tesla.Multipart'"], "product": "tesla", "versions": [{"status": "affected", "version": "6ebfdb9abe9c6f119408045b933d82462decd351", "lessThan": "23601edac5d22ba9407b427967b5bdbda201aec2", "versionType": "git"}], "packageURL": "pkg:github/elixir-tesla/tesla", "packageName": "elixir-tesla/tesla", "programFiles": ["lib/tesla/multipart.ex"], "collectionURL": "https://github.com", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Tesla.Multipart':add_content_type_param/2"}, {"name": "'Elixir.Tesla.Multipart':headers/1"}]}]}], "published": "2026-06-02T20:16:38.557", "references": [{"url": "https://cna.erlef.org/cves/CVE-2026-48596.html", "tags": ["Third Party Advisory"], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://github.com/elixir-tesla/tesla/commit/23601edac5d22ba9407b427967b5bdbda201aec2", "tags": ["Broken Link"], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w", "tags": ["Exploit", "Vendor Advisory"], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-48596", "tags": ["Third Party Advisory"], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "description": [{"lang": "en", "value": "CWE-113"}]}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_type_param/2 appends caller-supplied strings to the multipart content_type_params list without validating for CR (\\r) or LF (\\n) characters. Tesla.Multipart.headers/1 then joins these params verbatim with \"; \" to construct the outgoing Content-Type header value. A param containing \\r\\n splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into add_content_type_param/2 is affected.\n\nThis issue affects tesla: from 0.8.0 before 1.18.3."}, {"lang": "es", "value": "La vulnerabilidad de Neutralizaci\u00f3n Inadecuada de Secuencias CRLF en Encabezados HTTP ('Divisi\u00f3n de Solicitud/Respuesta HTTP') en elixir-tesla tesla permite la inyecci\u00f3n de encabezados HTTP a trav\u00e9s de Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_type_param/2 a\u00f1ade cadenas proporcionadas por el llamador a la lista multipart content_type_params sin validar los caracteres CR (\\r) o LF (\\n). Tesla.Multipart.headers/1 luego une estos par\u00e1metros textualmente con '; ' para construir el valor del encabezado Content-Type saliente. Un par\u00e1metro que contiene \\r\\n divide la l\u00ednea del encabezado, permitiendo que se inyecten encabezados arbitrarios en la solicitud HTTP saliente. Cualquier aplicaci\u00f3n que reenv\u00ede entrada no confiable (como un charset o una cadena de par\u00e1metro proporcionados por el usuario) a add_content_type_param/2 se ve afectada.\n\nEste problema afecta a tesla: desde 0.8.0 antes de 1.18.3."}], "lastModified": "2026-08-19T14:08:05.800", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "876BFB6A-2010-4450-9EA4-F4AF4B78F93F", "versionEndExcluding": "1.18.3", "versionStartIncluding": "0.8.0"}], "operator": "OR"}]}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}