{"id":"CVE-2026-48596","title":"Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_typ…","summary":"Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_typ…","severity":"low","cvss":3.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","cwe":["CWE-113","CWE-93"],"vendor":"elixir-tesla","product":"tesla","affected":["tesla >= 0.8.0, < 1.18.3"],"patched":["tesla 1.18.3"],"published":"2026-06-02","updated":"2026-09-24","sourceUpdated":"2026-09-24T21:17:13.370","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-48596","references":[{"url":"https://cna.erlef.org/cves/CVE-2026-48596.html","label":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/elixir-tesla/tesla/commit/23601edac5d22ba9407b427967b5bdbda201aec2","label":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/elixir-tesla/tesla/commit/6ebfdb9abe9c6f119408045b933d82462decd351","label":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w","label":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-48596","label":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48596"},{"url":"https://github.com/advisories/GHSA-q7jx-v53g-848w"}],"tags":["nvd","cve.org","exploit-available","ghsa","erlang"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-06-03T13:01:48.568462Z"},"scores":{"nvd":3.7,"cna":2.1},"epss":0.00239,"epssPercentile":0.1491,"aliases":["GHSA-q7jx-v53g-848w"],"ecosystem":"erlang","ingestedAt":"2026-07-10T00:54:12.246Z","slug":"CVE-2026-48596","body":"## Overview\n\nImproper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_type_param/2 appends caller-supplied strings to the multipart content_type_params list without validating for CR (\\r) or LF (\\n) characters. Tesla.Multipart.headers/1 then joins these params verbatim with \"; \" to construct the outgoing Content-Type header value. A param containing \\r\\n splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into add_content_type_param/2 is affected.\n\nThis issue affects tesla: from 0.8.0 before 1.18.3.\n\n## Affected\n\n- `tesla >= 0.8.0, < 1.18.3`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `tesla 1.18.3`\n\n## Package advisory (CVE-2026-48596)\n\nAffected packages:\n\n- `tesla >= 0.8.0, < 1.18.3`\n\nPatched in:\n\n- `tesla 1.18.3`\n\nSource: https://github.com/advisories/GHSA-q7jx-v53g-848w","depth":"twilight","depthScore":32,"depthScoreParts":{"impact":20.4,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":210385,"id":"CVE-2026-48596","ts":1790286814882,"field":"exploit_available","old":"false","new":"true"},{"seq":210384,"id":"CVE-2026-48596","ts":1790286814882,"field":"cvss","old":null,"new":"3.7"}]}