https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 08:13:07 +0000 https://cve.radiocsirt.org/vuln/cve-2026-49756 <p><strong>Affected:</strong> wojtekmach req</p> <p>Improper Neutralization of CRLF Sequences (&#39;CRLF Injection&#39;) vulnerability in wojtekmach Req allows multipart parameter smuggling via attacker-influenced part metadata.</p> <p>Req.Utils.encode_form_part/2 in lib/req/utils.ex builds the per-part headers by interpolating the caller-supplied name, filename, and content_type values directly into the content-disposition and content-type lines with no escaping or CRLF stripping. A value containing &#34;, \r, or \n closes the surrounding quoted value and starts a new header line; an additional \r\n--&lt;boundary&gt; terminates the current part and prepends a smuggled part of the attacker&#39;s choosing.</p> <p>This is reachable through every supported way of supplying a part. It is particularly easy when value is a %File.Stream{}, because filename then defaults to Path.basename(stream.path) and POSIX filenames may legitimately contain \r and \n. Any application that forwards user-controlled filenames (or field names / MIME types) through Req.post/2 with form_multipart: lets an attacker inject arbitrary headers into the outgoing multipart body or smuggle additional fields and parts into the request the victim service sends downstream.</p> <p>This issue affects req: from 0.5.3 before 0.6.0.</p> <p><strong>Affected:</strong> wojtekmach req</p> <p>Improper Neutralization of CRLF Sequences (&#39;CRLF Injection&#39;) vulnerability in wojtekmach Req allows multipart parameter smuggling via attacker-influenced part metadata.</p> <p>Req.Utils.encode_form_part/2 in lib/req/utils.ex builds the per-part headers by interpolating the caller-supplied name, filename, and content_type values directly into the content-disposition and content-type lines with no escaping or CRLF stripping. A value containing &#34;, \r, or \n closes the surrounding quoted value and starts a new header line; an additional \r\n--&lt;boundary&gt; terminates the current part and prepends a smuggled part of the attacker&#39;s choosing.</p> <p>This is reachable through every supported way of supplying a part. It is particularly easy when value is a %File.Stream{}, because filename then defaults to Path.basename(stream.path) and POSIX filenames may legitimately contain \r and \n. Any application that forwards user-controlled filenames (or field names / MIME types) through Req.post/2 with form_multipart: lets an attacker inject arbitrary headers into the outgoing multipart body or smuggle additional fields and parts into the request the victim service sends downstream.</p> <p>This issue affects req: from 0.5.3 before 0.6.0.</p> https://cve.radiocsirt.org/vuln/cve-2026-49756