Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 06:27:15 +0000 CVE-2026-48596 — CRLF injection in Tesla.Multipart.add_content_type_param/2 allows HTTP header injection https://cve.radiocsirt.org/vuln/cve-2026-48596 <p><strong>Affected:</strong> elixir-tesla tesla</p> <p>Improper Neutralization of CRLF Sequences in HTTP Headers (&#39;HTTP Request/Response Splitting&#39;) vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2.</p> <p>Tesla.Multipart.add_content_type_param/2 appends caller-supplied strings to the multipart content_type_params list without validating for CR (\r) or LF (\n) characters. Tesla.Multipart.headers/1 then joins these params verbatim with &#34;; &#34; to construct the outgoing Content-Type header value. A param containing \r\n splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into add_content_type_param/2 is affected.</p> <p>This issue affects tesla: from 0.8.0 before 1.18.3.</p> <p><strong>Affected:</strong> elixir-tesla tesla</p> <p>Improper Neutralization of CRLF Sequences in HTTP Headers (&#39;HTTP Request/Response Splitting&#39;) vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2.</p> <p>Tesla.Multipart.add_content_type_param/2 appends caller-supplied strings to the multipart content_type_params list without validating for CR (\r) or LF (\n) characters. Tesla.Multipart.headers/1 then joins these params verbatim with &#34;; &#34; to construct the outgoing Content-Type header value. A param containing \r\n splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into add_content_type_param/2 is affected.</p> <p>This issue affects tesla: from 0.8.0 before 1.18.3.</p> https://cve.radiocsirt.org/vuln/cve-2026-48596