CVE-2026-48596 Details
Description
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2. Tesla.Multipart.add_content_type_param/2 appends caller-supplied strings to the multipart content_type_params list without validating for CR (\r) or LF (\n) characters. Tesla.Multipart.headers/1 then joins these params verbatim with "; " to construct the outgoing Content-Type header value. A param containing \r\n splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into add_content_type_param/2 is affected. This issue affects tesla: from 0.8.0 before 1.18.3.
A CRLF injection vulnerability has been identified in the Elixir Tesla library, specifically in versions 0.8.0 prior to 1.18.3. This vulnerability allows HTTP header injection through the `Tesla.Multipart.add_content_type_param/2` function, which appends user-supplied strings to the multipart `content_type_params` list without proper validation for carriage return or line feed characters. As a result, a parameter containing ` ` can split the header line and inject arbitrary headers into the outgoing HTTP request. Applications that forward untrusted input into `add_content_type_param/2` are affected.
The vulnerability has been patched in Tesla version 1.18.3. Users should upgrade to this version. For applications that cannot immediately upgrade, validate content-type parameter strings to ensure they do not contain ` ` or ` ` before passing them to `add_content_type_param/2`.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w | CISA-ADP | ExploitVendor Advisory |
| https://cna.erlef.org/cves/CVE-2026-48596.html | EEF | Third Party Advisory |
| https://github.com/elixir-tesla/tesla/commit/23601edac5d22ba9407b427967b5bdbda201aec2 | EEF | Broken Link |
| https://github.com/elixir-tesla/tesla/commit/6ebfdb9abe9c6f119408045b933d82462decd351 | EEF | |
| https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w | EEF | ExploitVendor Advisory |
| https://osv.dev/vulnerability/EEF-CVE-2026-48596 | EEF | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-113 | Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') | EEF |
Affected Products
| Product | Versions |
|---|---|
| elixir-tesla tesla | >= 0.8.0, < 1.18.3 |
CPE
Remediation
| |
Change History
9 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Sep 24, 2026 | CVE Modified | EEF |
| Aug 19, 2026 | Reanalysis | [email protected] |
| Aug 17, 2026 | Initial Analysis | [email protected] |
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | EEF |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 3, 2026 | CVE Modified | CISA-ADP |
| Jun 2, 2026 | New CVE Received | EEF |