Vulnerability in Elixir-Tesla Tesla
CVE-2026-48596
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2. Tesla.Multipart.add_content_type_param/2 appends caller-supplied strings to the multipart content_type_params list without validating for CR (\r) or LF (\n) characters. Tesla.Multipart.headers/1 then joins these params verbatim with "; " to construct the outgoing Content-Type header value. A param containing \r\n splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into add_content_type_param/2 is affected. This issue affects tesla: from 0.8.0 before 1.18.3.
EPSS: 0.002 (14.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N.
Affected products
- Elixir-tesla Tesla — versions 0.8.0, 6ebfdb9abe9c6f119408045b933d82462decd351
Weakness classification (CWE)
References
- 6b3ad84c-e1a6-4bf7-a703-f496b71e49db (related, Exploit, vendor-advisory, Vendor Advisory)
- 6b3ad84c-e1a6-4bf7-a703-f496b71e49db (related, Third Party Advisory)
- 6b3ad84c-e1a6-4bf7-a703-f496b71e49db (related, Third Party Advisory)
- 6b3ad84c-e1a6-4bf7-a703-f496b71e49db (patch, Broken Link)
Frequently asked questions
- What is CVE-2026-48596?
- CVE-2026-48596 is a low-severity vulnerability in Elixir-Tesla Tesla, classified under HTTP Response Splitting. CVSS score: 3.7/10. Published 2026-06-02.
- How severe is CVE-2026-48596?
- Low severity. CVSS v3 base score is 3.7 out of 10.