HTTP Header Injection Vulnerability in Tesla by Elixir
CVE-2026-48596

2.1LOW

Key Information:

Vendor

Elixir-tesla

Status
Tesla
Vendor
CVE Published:
2 June 2026

What is CVE-2026-48596?

The vulnerability allows HTTP header injection through improper handling of CRLF sequences in HTTP headers when using the Tesla library in Elixir. The method Tesla.Multipart.add_content_type_param/2 appends unsanitized input directly into the HTTP header, enabling attackers to exploit untrusted user inputs by injecting arbitrary headers into outbound requests. Affected applications include those that route these inputs without proper validation, risking data exposure or further attacks.

Affected Version(s)

tesla 0.8.0 < 1.18.3

tesla 6ebfdb9abe9c6f119408045b933d82462decd351 < 23601edac5d22ba9407b427967b5bdbda201aec2

References

https://github.com/elixir-tesla/tesla/security/advisories...
vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-48596.html
related
https://osv.dev/vulnerability/EEF-CVE-2026-48596
related

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Peter Ullrich
Yordis Prieto
Jonatan Männchen
.