CVE-2026-48596

Name of the Vulnerable Software and Affected Versions tesla versions 0.8.0 through 1.18.2

Description Improper neutralization of CRLF (Carriage Return and Line Feed) sequences in HTTP headers allows for HTTP header injection. The function Tesla.Multipart.add content type param/2 appends caller-supplied strings to the multipart content type params list without validating for r or characters. Subsequently, the Tesla.Multipart.headers/1 function joins these parameters verbatim to construct the outgoing Content-Type header. An attacker providing a parameter containing r can split the header line, enabling the injection of arbitrary headers into the outbound HTTP request. This issue affects applications that forward untrusted input, such as user-supplied charset or parameter strings, into the Tesla.Multipart.add content type param/2 function. This can lead to forging outbound request headers or potential request smuggling against the upstream server.

Recommendations Update tesla to version 1.18.3. As a temporary workaround, validate content-type parameter strings before passing them to the Tesla.Multipart.add content type param/2 function, rejecting any value that contains r or .