CVE-2026-48596
published 2026-06-02CVE-2026-48596: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection…
PriorityP420low3.7CVSS 3.1
AVNACHPRNUINSUCNILAN
EPSS
0.35%
27.3th percentile
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2.
Tesla.Multipart.add_content_type_param/2 appends caller-supplied strings to the multipart content_type_params list without validating for CR (\r) or LF (\n) characters. Tesla.Multipart.headers/1 then joins these params verbatim with "; " to construct the outgoing Content-Type header value. A param containing \r\n splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into add_content_type_param/2 is affected.
This issue affects tesla: from 0.8.0 before 1.18.3.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elixir-tesla | tesla | >= 0.8.0 < 1.18.3 | 1.18.3 |
| elixir-tesla | tesla | >= 6ebfdb9abe9c6f119408045b933d82462decd351 < 23601edac5d22ba9407b427967b5bdbda201aec2 | 23601edac5d22ba9407b427967b5bdbda201aec2 |
| nvidia | tesla | >= 0.8.0 < 1.18.3 | 1.18.3 |
CVSS provenance
nvdv3.13.7LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
nvdv4.02.1LOWCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Tesla has CRLF injection in request `Content-Type` header via `add_content_type_param`
ghsa·2026-07-10
CVE-2026-48596 [LOW] CWE-113 Tesla has CRLF injection in request `Content-Type` header via `add_content_type_param`
Tesla has CRLF injection in request `Content-Type` header via `add_content_type_param`
### Summary
`Tesla.Multipart.add_content_type_param/2` appends caller-supplied strings to the multipart `Content-Type` header with no validation. A param value containing `\r\n` splits the header line, allowing an attacker who controls any content-type parameter (charset, boundary parameter, etc.) to inject arbitrary headers into the outbound HTTP request.
### Details
`add_content_type_param/2` in `lib/tesla/multipart.ex` stores the supplied string directly in `multipart.content_type_params` without any CR/LF check. `headers/1` then joins all params with `"; "` and appends the result verbatim to the `Content-Type` header value. Because HTTP headers are delimited by `\r\n`, a param containing that seq
VulDB
elixir-tesla up to 1.18.2 add_content_type_param response splitting (GHSA-q7jx-v53g-848w)
vuldb·2026-06-03·CVSS 2.1
CVE-2026-48596 [LOW] elixir-tesla up to 1.18.2 add_content_type_param response splitting (GHSA-q7jx-v53g-848w)
A vulnerability categorized as problematic has been discovered in elixir-tesla tesla up to 1.18.2. This affects the function add_content_type_param. Executing a manipulation can lead to http response splitting.
This vulnerability appears as CVE-2026-48596. The attack requires local access. There is no available exploit.
It is advisable to upgrade the affected component.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://cna.erlef.org/cves/CVE-2026-48596.htmlhttps://github.com/elixir-tesla/tesla/commit/23601edac5d22ba9407b427967b5bdbda201aec2https://github.com/elixir-tesla/tesla/commit/6ebfdb9abe9c6f119408045b933d82462decd351https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848whttps://osv.dev/vulnerability/EEF-CVE-2026-48596https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w
2026-06-02
Published