CVE-2026-48596Low▾ SunlitTesla has CRLF injection in request `Content-Type` header via `add_content_type_param`
▾ Sunlit zone — Low / medium · no exploitation signal
impact 13.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 10.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.2%
0.2% → 0.2%
Tesla.Multipart.add_content_type_param/2 appends caller-supplied strings to the multipart Content-Type header with no validation. A param value containing \r\n splits the header line, allowing an attacker who controls any content-type parameter (charset, boundary parameter, etc.) to inject arbitrary headers into the outbound HTTP request.
add_content_type_param/2 in lib/tesla/multipart.ex stores the supplied string directly in multipart.content_type_params without any CR/LF check. headers/1 then joins all params with "; " and appends the result verbatim to the Content-Type header value. Because HTTP headers are delimited by \r\n, a param containing that sequence breaks out of the header field and introduces new header lines before the adapter writes the request to the socket.
The precondition is that untrusted input reaches add_content_type_param/2, which is the normal pattern for applications that accept user-supplied charset values, file type parameters, or any other content-type extension fields.
Tesla.Multipart.add_content_type_param/2 with a value containing \r\nX-Injected: pwned.Multipart struct as the request body via any Tesla adapter.X-Injected: pwned as a standalone header line.Low severity (CVSS v4.0: 2.1). Any application using tesla 0.8.0 through 1.18.2 that passes untrusted input into Tesla.Multipart.add_content_type_param/2 is affected. Consequences range from forging arbitrary outbound request headers to potential request smuggling against the upstream server. Fixed in tesla 1.18.3.
Validate content-type parameter strings before passing them to Tesla.Multipart.add_content_type_param/2, rejecting any value that contains \r or \n.
tesla >= 0.8.0, < 1.18.3Upgrade to a patched release:
tesla 1.18.3Connected by shared product, vendor, weakness, or advisory.
CVE-2026-48594HighTesla has decompression bomb on response body
CVE-2026-48595HighTesla: Authorization header leaks on cross-origin redirect via case-sensitive filtering
CVE-2026-48597HighTesla vulnerable to atom exhaustion via untrusted URL scheme
CVE-2026-48598LowTesla vulnerable to multipart part smuggling via unescaped `content-disposition` values
CVE-2026-85077High· 8.2Sanic is an opensource python web server/framework
CVE-2024-58384Medium· 5.4Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers