Vulnerability in Wojtekmach Req
CVE-2026-49756
Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in wojtekmach Req allows multipart parameter smuggling via attacker-influenced part metadata. Req.Utils.encode_form_part/2 in lib/req/utils.ex builds the per-part…
Vulnerability class: CRLF Injection
EPSS: 0.002 (7.6th percentile) — read the EPSS interpretation.
Affected products
- Wojtekmach Req — versions 0.5.3, 60253dbe9436cb8e9c738f895032f2e87939b597
Weakness classification (CWE)
References
- 6b3ad84c-e1a6-4bf7-a703-f496b71e49db (related)
- 6b3ad84c-e1a6-4bf7-a703-f496b71e49db (patch)
- 6b3ad84c-e1a6-4bf7-a703-f496b71e49db (related, vendor-advisory)
- 6b3ad84c-e1a6-4bf7-a703-f496b71e49db (related)