Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTT…

cve CVE-2026-48596 1 source, 1 claim · Watch

NVD writes:
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2. Tesla.Multipart.add_content_type_param/2 appends caller-supplied strings to the multipart content_type_params list without validating for CR (\r) or LF (\n) characters. Tesla.Multipart.headers/1 then joins these params verbatim with "; " to construct the outgoing Content-Type header value. A param containing \r\n splits the header line, allowing arbitrary headers to be injected into the outb… the claim

Severity: LOW NVD
CVSS: 3.7 NVD
Fixed in: 1.18.3 NVD
Vendor: elixir-tesla NVD
Product: tesla NVD
CWE: CWE-113 NVD

How far exploitation has got

No public code known
Proof of concept
Proof of concept, verified
A Metasploit module
Exploited in the wild
Used in ransomware campaigns

Timeline

2026-06-02

first spoke of it: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2. Tesla.Multipart.add_content_type_param/2 appends caller-supplied strings to the multipart content_type_params list without validating for CR (\r) or LF (\n) characters. Tesla.Multipart.headers/1 then joins these params verbatim with "; " to construct the outgoing Content-Type header value. A param containing \r\n splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into add_content_type_param/2 is affected. This issue affects tesla: from 0.8.0 before 1.18.3.

NVD

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2. Tesla.Multipart.add_content_type_param/2 appends caller-supplied strings to the multipart content_type_params list without validating for CR (\r) or LF (\n) characters. Tesla.Multipart.headers/1 then joins these params verbatim with "; " to construct the outgoing Content-Type header value. A param containing \r\n splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into add_content_type_param/2 is affected. This issue affects tesla: from 0.8.0 before 1.18.3.

What it is to other things

affects	elixir-tesla/tesla NVD
made_by	elixir-tesla NVD

In words only, so not counted until a person confirms one:

made_by	`elixir_tesla` NVD says “elixir-tesla”
affects	`elixir_tesla/tesla` NVD says “elixir-tesla · tesla”

Every value, with what each source said and its receipt

Property Source Said Means here

Automatable

automatable

NVD

At least one of those steps needs a person.

receipt

Source: NVD
Its words: no
Read by: field:cve.metrics.ssvcV203[].ssvcData.options[].automatable
Said since: 2026-10-06 12:29 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:29 UTC	no
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://repo.hex.pm",
            "cpes": [
              "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "modules": [
              "'Elixir.Tesla.Multipart'"
            ],
            "packageName": "tesla",
            "packageURL": "pkg:hex/tesla",
            "product": "tesla",
            "programFiles": [
              "lib/tesla/multipart.ex"
            ],
            "programRoutines": [
              {
                "name": "'Elixir.Tesla.Multipart':add_content_type_param/2"
              },
              {
                "name": "'Elixir.Tesla.Multipart':headers/1"
              }
            ],
            "repo": "https://github.com/elixir-tesla/tesla",
            "vendor": "elixir-tesla",
            "versions": [
              {
                "lessThan": "1.18.3",
                "status": "affected",
                "version": "0.8.0",
                "versionType": "semver"
              }
            ]
          },
          {
            "collectionURL": "https://github.com",
            "cpes": [
              "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "modules": [
              "'Elixir.Tesla.Multipart'"
            ],
            "packageName": "elixir-tesla/tesla",
            "packageURL": "pkg:github/elixir-tesla/tesla",
            "product": "tesla",
            "programFiles": [
              "lib/tesla/multipart.ex"
            ],
            "programRoutines": [
              {
                "name": "'Elixir.Tesla.Multipart':add_content_type_param/2"
              },
              {
                "name": "'Elixir.Tesla.Multipart':headers/1"
              }
            ],
            "repo": "https://github.com/elixir-tesla/tesla",
            "vendor": "elixir-tesla",
            "versions": [
              {
                "lessThan": "23601edac5d22ba9407b427967b5bdbda201aec2",
                "status": "affected",
                "version": "6ebfdb9abe9c6f119408045b933d82462decd351",
                "versionType": "git"
              }
            ]
          }
        ],
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "876BFB6A-2010-4450-9EA4-F4AF4B78F93F",
                "versionEndExcluding": "1.18.3",
                "versionStartIncluding": "0.8.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_type_param/2 appends caller-supplied strings to the multipart content_type_params list without validating for CR (\\r) or LF (\\n) characters. Tesla.Multipart.headers/1 then joins these params verbatim with \"; \" to construct the outgoing Content-Type header value. A param containing \\r\\n splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into add_content_type_param/2 is affected.\n\nThis issue affects tesla: from 0.8.0 before 1.18.3."
      },
      {
        "lang": "es",
        "value": "La vulnerabilidad de Neutralización Inadecuada de Secuencias CRLF en Encabezados HTTP ('División de Solicitud/Respuesta HTTP') en elixir-tesla tesla permite la inyección de encabezados HTTP a través de Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_type_param/2 añade cadenas proporcionadas por el llamador a la lista multipart content_type_params sin validar los caracteres CR (\\r) o LF (\\n). Tesla.Multipart.headers/1 luego une estos parámetros textualmente con '; ' para construir el valor del encabezado Content-Type saliente. Un parámetro que contiene \\r\\n divide la línea del encabezado, permitiendo que se inyecten encabezados arbitrarios en la solicitud HTTP saliente. Cualquier aplicación que reenvíe entrada no confiable (como un charset o una cadena de parámetro proporcionados por el usuario) a add_content_type_param/2 se ve afectada.\n\nEste problema afecta a tesla: desde 0.8.0 antes de 1.18.3."
      }
    ],
    "id": "CVE-2026-48596",
    "lastModified": "2026-09-24T21:17:13.370",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 1.4,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "NOT_DEFINED",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-48596",
            "options": [
              {
                "exploitation": "poc"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-06-03T13:01:48.568462Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-06-02T20:16:38.557",
    "references": [
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://cna.erlef.org/cves/CVE-2026-48596.html"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Broken Link"
        ],
        "url": "https://github.com/elixir-tesla/tesla/commit/23601edac5d22ba9407b427967b5bdbda201aec2"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "url": "https://github.com/elixir-tesla/tesla/commit/6ebfdb9abe9c6f119408045b933d82462decd351"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Exploit",
          "Vendor Advisory"
        ],
        "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48596"
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "tags": [
          "Exploit",
          "Vendor Advisory"
        ],
        "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w"
      }
    ],
    "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-113"
          }
        ],
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ]
  }
}

—

CVSS

cvss

NVD

3.7

receipt

Source: NVD
Its words: 3.7
Read by: field:cve.metrics.cvssMetricV31[type=Primary].cvssData.baseScore || field:cve.metrics.cvssMetricV31[].cvssData.baseScore
Said since: 2026-09-29 09:45 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://repo.hex.pm",
            "cpes": [
              "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "modules": [
              "'Elixir.Tesla.Multipart'"
            ],
            "packageName": "tesla",
            "packageURL": "pkg:hex/tesla",
            "product": "tesla",
            "programFiles": [
              "lib/tesla/multipart.ex"
            ],
            "programRoutines": [
              {
                "name": "'Elixir.Tesla.Multipart':add_content_type_param/2"
              },
              {
                "name": "'Elixir.Tesla.Multipart':headers/1"
              }
            ],
            "repo": "https://github.com/elixir-tesla/tesla",
            "vendor": "elixir-tesla",
            "versions": [
              {
                "lessThan": "1.18.3",
                "status": "affected",
                "version": "0.8.0",
                "versionType": "semver"
              }
            ]
          },
          {
            "collectionURL": "https://github.com",
            "cpes": [
              "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "modules": [
              "'Elixir.Tesla.Multipart'"
            ],
            "packageName": "elixir-tesla/tesla",
            "packageURL": "pkg:github/elixir-tesla/tesla",
            "product": "tesla",
            "programFiles": [
              "lib/tesla/multipart.ex"
            ],
            "programRoutines": [
              {
                "name": "'Elixir.Tesla.Multipart':add_content_type_param/2"
              },
              {
                "name": "'Elixir.Tesla.Multipart':headers/1"
              }
            ],
            "repo": "https://github.com/elixir-tesla/tesla",
            "vendor": "elixir-tesla",
            "versions": [
              {
                "lessThan": "23601edac5d22ba9407b427967b5bdbda201aec2",
                "status": "affected",
                "version": "6ebfdb9abe9c6f119408045b933d82462decd351",
                "versionType": "git"
              }
            ]
          }
        ],
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "876BFB6A-2010-4450-9EA4-F4AF4B78F93F",
                "versionEndExcluding": "1.18.3",
                "versionStartIncluding": "0.8.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_type_param/2 appends caller-supplied strings to the multipart content_type_params list without validating for CR (\\r) or LF (\\n) characters. Tesla.Multipart.headers/1 then joins these params verbatim with \"; \" to construct the outgoing Content-Type header value. A param containing \\r\\n splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into add_content_type_param/2 is affected.\n\nThis issue affects tesla: from 0.8.0 before 1.18.3."
      },
      {
        "lang": "es",
        "value": "La vulnerabilidad de Neutralización Inadecuada de Secuencias CRLF en Encabezados HTTP ('División de Solicitud/Respuesta HTTP') en elixir-tesla tesla permite la inyección de encabezados HTTP a través de Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_type_param/2 añade cadenas proporcionadas por el llamador a la lista multipart content_type_params sin validar los caracteres CR (\\r) o LF (\\n). Tesla.Multipart.headers/1 luego une estos parámetros textualmente con '; ' para construir el valor del encabezado Content-Type saliente. Un parámetro que contiene \\r\\n divide la línea del encabezado, permitiendo que se inyecten encabezados arbitrarios en la solicitud HTTP saliente. Cualquier aplicación que reenvíe entrada no confiable (como un charset o una cadena de parámetro proporcionados por el usuario) a add_content_type_param/2 se ve afectada.\n\nEste problema afecta a tesla: desde 0.8.0 antes de 1.18.3."
      }
    ],
    "id": "CVE-2026-48596",
    "lastModified": "2026-09-24T21:17:13.370",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 1.4,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "NOT_DEFINED",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-48596",
            "options": [
              {
                "exploitation": "poc"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-06-03T13:01:48.568462Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-06-02T20:16:38.557",
    "references": [
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://cna.erlef.org/cves/CVE-2026-48596.html"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Broken Link"
        ],
        "url": "https://github.com/elixir-tesla/tesla/commit/23601edac5d22ba9407b427967b5bdbda201aec2"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "url": "https://github.com/elixir-tesla/tesla/commit/6ebfdb9abe9c6f119408045b933d82462decd351"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Exploit",
          "Vendor Advisory"
        ],
        "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48596"
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "tags": [
          "Exploit",
          "Vendor Advisory"
        ],
        "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w"
      }
    ],
    "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-113"
          }
        ],
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ]
  }
}

—

Cvss4

cvss4

NVD

2.1

receipt

Source: NVD
Its words: 2.1
Read by: field:cve.metrics.cvssMetricV40[type=Primary].cvssData.baseScore || field:cve.metrics.cvssMetricV40[].cvssData.baseScore
Said since: 2026-10-06 12:29 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:29 UTC	2.1
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://repo.hex.pm",
            "cpes": [
              "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "modules": [
              "'Elixir.Tesla.Multipart'"
            ],
            "packageName": "tesla",
            "packageURL": "pkg:hex/tesla",
            "product": "tesla",
            "programFiles": [
              "lib/tesla/multipart.ex"
            ],
            "programRoutines": [
              {
                "name": "'Elixir.Tesla.Multipart':add_content_type_param/2"
              },
              {
                "name": "'Elixir.Tesla.Multipart':headers/1"
              }
            ],
            "repo": "https://github.com/elixir-tesla/tesla",
            "vendor": "elixir-tesla",
            "versions": [
              {
                "lessThan": "1.18.3",
                "status": "affected",
                "version": "0.8.0",
                "versionType": "semver"
              }
            ]
          },
          {
            "collectionURL": "https://github.com",
            "cpes": [
              "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "modules": [
              "'Elixir.Tesla.Multipart'"
            ],
            "packageName": "elixir-tesla/tesla",
            "packageURL": "pkg:github/elixir-tesla/tesla",
            "product": "tesla",
            "programFiles": [
              "lib/tesla/multipart.ex"
            ],
            "programRoutines": [
              {
                "name": "'Elixir.Tesla.Multipart':add_content_type_param/2"
              },
              {
                "name": "'Elixir.Tesla.Multipart':headers/1"
              }
            ],
            "repo": "https://github.com/elixir-tesla/tesla",
            "vendor": "elixir-tesla",
            "versions": [
              {
                "lessThan": "23601edac5d22ba9407b427967b5bdbda201aec2",
                "status": "affected",
                "version": "6ebfdb9abe9c6f119408045b933d82462decd351",
                "versionType": "git"
              }
            ]
          }
        ],
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "876BFB6A-2010-4450-9EA4-F4AF4B78F93F",
                "versionEndExcluding": "1.18.3",
                "versionStartIncluding": "0.8.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_type_param/2 appends caller-supplied strings to the multipart content_type_params list without validating for CR (\\r) or LF (\\n) characters. Tesla.Multipart.headers/1 then joins these params verbatim with \"; \" to construct the outgoing Content-Type header value. A param containing \\r\\n splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into add_content_type_param/2 is affected.\n\nThis issue affects tesla: from 0.8.0 before 1.18.3."
      },
      {
        "lang": "es",
        "value": "La vulnerabilidad de Neutralización Inadecuada de Secuencias CRLF en Encabezados HTTP ('División de Solicitud/Respuesta HTTP') en elixir-tesla tesla permite la inyección de encabezados HTTP a través de Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_type_param/2 añade cadenas proporcionadas por el llamador a la lista multipart content_type_params sin validar los caracteres CR (\\r) o LF (\\n). Tesla.Multipart.headers/1 luego une estos parámetros textualmente con '; ' para construir el valor del encabezado Content-Type saliente. Un parámetro que contiene \\r\\n divide la línea del encabezado, permitiendo que se inyecten encabezados arbitrarios en la solicitud HTTP saliente. Cualquier aplicación que reenvíe entrada no confiable (como un charset o una cadena de parámetro proporcionados por el usuario) a add_content_type_param/2 se ve afectada.\n\nEste problema afecta a tesla: desde 0.8.0 antes de 1.18.3."
      }
    ],
    "id": "CVE-2026-48596",
    "lastModified": "2026-09-24T21:17:13.370",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 1.4,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "NOT_DEFINED",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-48596",
            "options": [
              {
                "exploitation": "poc"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-06-03T13:01:48.568462Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-06-02T20:16:38.557",
    "references": [
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://cna.erlef.org/cves/CVE-2026-48596.html"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Broken Link"
        ],
        "url": "https://github.com/elixir-tesla/tesla/commit/23601edac5d22ba9407b427967b5bdbda201aec2"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "url": "https://github.com/elixir-tesla/tesla/commit/6ebfdb9abe9c6f119408045b933d82462decd351"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Exploit",
          "Vendor Advisory"
        ],
        "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48596"
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "tags": [
          "Exploit",
          "Vendor Advisory"
        ],
        "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w"
      }
    ],
    "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-113"
          }
        ],
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ]
  }
}

—

Cvss4 vector

cvss4_vector

NVD

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

receipt

Source: NVD
Its words: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Read by: field:cve.metrics.cvssMetricV40[type=Primary].cvssData.vectorString || field:cve.metrics.cvssMetricV40[].cvssData.vectorString
Said since: 2026-10-06 12:29 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:29 UTC	CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://repo.hex.pm",
            "cpes": [
              "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "modules": [
              "'Elixir.Tesla.Multipart'"
            ],
            "packageName": "tesla",
            "packageURL": "pkg:hex/tesla",
            "product": "tesla",
            "programFiles": [
              "lib/tesla/multipart.ex"
            ],
            "programRoutines": [
              {
                "name": "'Elixir.Tesla.Multipart':add_content_type_param/2"
              },
              {
                "name": "'Elixir.Tesla.Multipart':headers/1"
              }
            ],
            "repo": "https://github.com/elixir-tesla/tesla",
            "vendor": "elixir-tesla",
            "versions": [
              {
                "lessThan": "1.18.3",
                "status": "affected",
                "version": "0.8.0",
                "versionType": "semver"
              }
            ]
          },
          {
            "collectionURL": "https://github.com",
            "cpes": [
              "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "modules": [
              "'Elixir.Tesla.Multipart'"
            ],
            "packageName": "elixir-tesla/tesla",
            "packageURL": "pkg:github/elixir-tesla/tesla",
            "product": "tesla",
            "programFiles": [
              "lib/tesla/multipart.ex"
            ],
            "programRoutines": [
              {
                "name": "'Elixir.Tesla.Multipart':add_content_type_param/2"
              },
              {
                "name": "'Elixir.Tesla.Multipart':headers/1"
              }
            ],
            "repo": "https://github.com/elixir-tesla/tesla",
            "vendor": "elixir-tesla",
            "versions": [
              {
                "lessThan": "23601edac5d22ba9407b427967b5bdbda201aec2",
                "status": "affected",
                "version": "6ebfdb9abe9c6f119408045b933d82462decd351",
                "versionType": "git"
              }
            ]
          }
        ],
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "876BFB6A-2010-4450-9EA4-F4AF4B78F93F",
                "versionEndExcluding": "1.18.3",
                "versionStartIncluding": "0.8.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_type_param/2 appends caller-supplied strings to the multipart content_type_params list without validating for CR (\\r) or LF (\\n) characters. Tesla.Multipart.headers/1 then joins these params verbatim with \"; \" to construct the outgoing Content-Type header value. A param containing \\r\\n splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into add_content_type_param/2 is affected.\n\nThis issue affects tesla: from 0.8.0 before 1.18.3."
      },
      {
        "lang": "es",
        "value": "La vulnerabilidad de Neutralización Inadecuada de Secuencias CRLF en Encabezados HTTP ('División de Solicitud/Respuesta HTTP') en elixir-tesla tesla permite la inyección de encabezados HTTP a través de Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_type_param/2 añade cadenas proporcionadas por el llamador a la lista multipart content_type_params sin validar los caracteres CR (\\r) o LF (\\n). Tesla.Multipart.headers/1 luego une estos parámetros textualmente con '; ' para construir el valor del encabezado Content-Type saliente. Un parámetro que contiene \\r\\n divide la línea del encabezado, permitiendo que se inyecten encabezados arbitrarios en la solicitud HTTP saliente. Cualquier aplicación que reenvíe entrada no confiable (como un charset o una cadena de parámetro proporcionados por el usuario) a add_content_type_param/2 se ve afectada.\n\nEste problema afecta a tesla: desde 0.8.0 antes de 1.18.3."
      }
    ],
    "id": "CVE-2026-48596",
    "lastModified": "2026-09-24T21:17:13.370",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 1.4,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "NOT_DEFINED",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-48596",
            "options": [
              {
                "exploitation": "poc"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-06-03T13:01:48.568462Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-06-02T20:16:38.557",
    "references": [
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://cna.erlef.org/cves/CVE-2026-48596.html"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Broken Link"
        ],
        "url": "https://github.com/elixir-tesla/tesla/commit/23601edac5d22ba9407b427967b5bdbda201aec2"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "url": "https://github.com/elixir-tesla/tesla/commit/6ebfdb9abe9c6f119408045b933d82462decd351"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Exploit",
          "Vendor Advisory"
        ],
        "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48596"
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "tags": [
          "Exploit",
          "Vendor Advisory"
        ],
        "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w"
      }
    ],
    "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-113"
          }
        ],
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ]
  }
}

—

CVSS vector

cvss_vector

NVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

receipt

Source: NVD
Its words: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Read by: field:cve.metrics.cvssMetricV31[type=Primary].cvssData.vectorString || field:cve.metrics.cvssMetricV31[].cvssData.vectorString
Said since: 2026-10-06 12:29 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:29 UTC	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://repo.hex.pm",
            "cpes": [
              "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "modules": [
              "'Elixir.Tesla.Multipart'"
            ],
            "packageName": "tesla",
            "packageURL": "pkg:hex/tesla",
            "product": "tesla",
            "programFiles": [
              "lib/tesla/multipart.ex"
            ],
            "programRoutines": [
              {
                "name": "'Elixir.Tesla.Multipart':add_content_type_param/2"
              },
              {
                "name": "'Elixir.Tesla.Multipart':headers/1"
              }
            ],
            "repo": "https://github.com/elixir-tesla/tesla",
            "vendor": "elixir-tesla",
            "versions": [
              {
                "lessThan": "1.18.3",
                "status": "affected",
                "version": "0.8.0",
                "versionType": "semver"
              }
            ]
          },
          {
            "collectionURL": "https://github.com",
            "cpes": [
              "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "modules": [
              "'Elixir.Tesla.Multipart'"
            ],
            "packageName": "elixir-tesla/tesla",
            "packageURL": "pkg:github/elixir-tesla/tesla",
            "product": "tesla",
            "programFiles": [
              "lib/tesla/multipart.ex"
            ],
            "programRoutines": [
              {
                "name": "'Elixir.Tesla.Multipart':add_content_type_param/2"
              },
              {
                "name": "'Elixir.Tesla.Multipart':headers/1"
              }
            ],
            "repo": "https://github.com/elixir-tesla/tesla",
            "vendor": "elixir-tesla",
            "versions": [
              {
                "lessThan": "23601edac5d22ba9407b427967b5bdbda201aec2",
                "status": "affected",
                "version": "6ebfdb9abe9c6f119408045b933d82462decd351",
                "versionType": "git"
              }
            ]
          }
        ],
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "876BFB6A-2010-4450-9EA4-F4AF4B78F93F",
                "versionEndExcluding": "1.18.3",
                "versionStartIncluding": "0.8.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_type_param/2 appends caller-supplied strings to the multipart content_type_params list without validating for CR (\\r) or LF (\\n) characters. Tesla.Multipart.headers/1 then joins these params verbatim with \"; \" to construct the outgoing Content-Type header value. A param containing \\r\\n splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into add_content_type_param/2 is affected.\n\nThis issue affects tesla: from 0.8.0 before 1.18.3."
      },
      {
        "lang": "es",
        "value": "La vulnerabilidad de Neutralización Inadecuada de Secuencias CRLF en Encabezados HTTP ('División de Solicitud/Respuesta HTTP') en elixir-tesla tesla permite la inyección de encabezados HTTP a través de Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_type_param/2 añade cadenas proporcionadas por el llamador a la lista multipart content_type_params sin validar los caracteres CR (\\r) o LF (\\n). Tesla.Multipart.headers/1 luego une estos parámetros textualmente con '; ' para construir el valor del encabezado Content-Type saliente. Un parámetro que contiene \\r\\n divide la línea del encabezado, permitiendo que se inyecten encabezados arbitrarios en la solicitud HTTP saliente. Cualquier aplicación que reenvíe entrada no confiable (como un charset o una cadena de parámetro proporcionados por el usuario) a add_content_type_param/2 se ve afectada.\n\nEste problema afecta a tesla: desde 0.8.0 antes de 1.18.3."
      }
    ],
    "id": "CVE-2026-48596",
    "lastModified": "2026-09-24T21:17:13.370",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 1.4,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "NOT_DEFINED",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-48596",
            "options": [
              {
                "exploitation": "poc"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-06-03T13:01:48.568462Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-06-02T20:16:38.557",
    "references": [
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://cna.erlef.org/cves/CVE-2026-48596.html"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Broken Link"
        ],
        "url": "https://github.com/elixir-tesla/tesla/commit/23601edac5d22ba9407b427967b5bdbda201aec2"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "url": "https://github.com/elixir-tesla/tesla/commit/6ebfdb9abe9c6f119408045b933d82462decd351"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Exploit",
          "Vendor Advisory"
        ],
        "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48596"
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "tags": [
          "Exploit",
          "Vendor Advisory"
        ],
        "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w"
      }
    ],
    "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-113"
          }
        ],
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ]
  }
}

—

CWE

cwe

NVD

CWE-113

receipt

Source: NVD
Its words: CWE-113
Read by: field:cve.weaknesses[].description[].value
Said since: 2026-10-06 12:29 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:29 UTC	CWE-113
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://repo.hex.pm",
            "cpes": [
              "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "modules": [
              "'Elixir.Tesla.Multipart'"
            ],
            "packageName": "tesla",
            "packageURL": "pkg:hex/tesla",
            "product": "tesla",
            "programFiles": [
              "lib/tesla/multipart.ex"
            ],
            "programRoutines": [
              {
                "name": "'Elixir.Tesla.Multipart':add_content_type_param/2"
              },
              {
                "name": "'Elixir.Tesla.Multipart':headers/1"
              }
            ],
            "repo": "https://github.com/elixir-tesla/tesla",
            "vendor": "elixir-tesla",
            "versions": [
              {
                "lessThan": "1.18.3",
                "status": "affected",
                "version": "0.8.0",
                "versionType": "semver"
              }
            ]
          },
          {
            "collectionURL": "https://github.com",
            "cpes": [
              "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "modules": [
              "'Elixir.Tesla.Multipart'"
            ],
            "packageName": "elixir-tesla/tesla",
            "packageURL": "pkg:github/elixir-tesla/tesla",
            "product": "tesla",
            "programFiles": [
              "lib/tesla/multipart.ex"
            ],
            "programRoutines": [
              {
                "name": "'Elixir.Tesla.Multipart':add_content_type_param/2"
              },
              {
                "name": "'Elixir.Tesla.Multipart':headers/1"
              }
            ],
            "repo": "https://github.com/elixir-tesla/tesla",
            "vendor": "elixir-tesla",
            "versions": [
              {
                "lessThan": "23601edac5d22ba9407b427967b5bdbda201aec2",
                "status": "affected",
                "version": "6ebfdb9abe9c6f119408045b933d82462decd351",
                "versionType": "git"
              }
            ]
          }
        ],
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "876BFB6A-2010-4450-9EA4-F4AF4B78F93F",
                "versionEndExcluding": "1.18.3",
                "versionStartIncluding": "0.8.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_type_param/2 appends caller-supplied strings to the multipart content_type_params list without validating for CR (\\r) or LF (\\n) characters. Tesla.Multipart.headers/1 then joins these params verbatim with \"; \" to construct the outgoing Content-Type header value. A param containing \\r\\n splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into add_content_type_param/2 is affected.\n\nThis issue affects tesla: from 0.8.0 before 1.18.3."
      },
      {
        "lang": "es",
        "value": "La vulnerabilidad de Neutralización Inadecuada de Secuencias CRLF en Encabezados HTTP ('División de Solicitud/Respuesta HTTP') en elixir-tesla tesla permite la inyección de encabezados HTTP a través de Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_type_param/2 añade cadenas proporcionadas por el llamador a la lista multipart content_type_params sin validar los caracteres CR (\\r) o LF (\\n). Tesla.Multipart.headers/1 luego une estos parámetros textualmente con '; ' para construir el valor del encabezado Content-Type saliente. Un parámetro que contiene \\r\\n divide la línea del encabezado, permitiendo que se inyecten encabezados arbitrarios en la solicitud HTTP saliente. Cualquier aplicación que reenvíe entrada no confiable (como un charset o una cadena de parámetro proporcionados por el usuario) a add_content_type_param/2 se ve afectada.\n\nEste problema afecta a tesla: desde 0.8.0 antes de 1.18.3."
      }
    ],
    "id": "CVE-2026-48596",
    "lastModified": "2026-09-24T21:17:13.370",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 1.4,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "NOT_DEFINED",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-48596",
            "options": [
              {
                "exploitation": "poc"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-06-03T13:01:48.568462Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-06-02T20:16:38.557",
    "references": [
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://cna.erlef.org/cves/CVE-2026-48596.html"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Broken Link"
        ],
        "url": "https://github.com/elixir-tesla/tesla/commit/23601edac5d22ba9407b427967b5bdbda201aec2"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "url": "https://github.com/elixir-tesla/tesla/commit/6ebfdb9abe9c6f119408045b933d82462decd351"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Exploit",
          "Vendor Advisory"
        ],
        "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48596"
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "tags": [
          "Exploit",
          "Vendor Advisory"
        ],
        "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w"
      }
    ],
    "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-113"
          }
        ],
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ]
  }
}

—

Exploitation

exploitation

NVD

poc

A public proof of concept exists, or exploitation is trivial.

receipt

Source: NVD
Its words: poc
Read by: field:cve.metrics.ssvcV203[].ssvcData.options[].exploitation
Said since: 2026-10-06 12:29 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:29 UTC	poc
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://repo.hex.pm",
            "cpes": [
              "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "modules": [
              "'Elixir.Tesla.Multipart'"
            ],
            "packageName": "tesla",
            "packageURL": "pkg:hex/tesla",
            "product": "tesla",
            "programFiles": [
              "lib/tesla/multipart.ex"
            ],
            "programRoutines": [
              {
                "name": "'Elixir.Tesla.Multipart':add_content_type_param/2"
              },
              {
                "name": "'Elixir.Tesla.Multipart':headers/1"
              }
            ],
            "repo": "https://github.com/elixir-tesla/tesla",
            "vendor": "elixir-tesla",
            "versions": [
              {
                "lessThan": "1.18.3",
                "status": "affected",
                "version": "0.8.0",
                "versionType": "semver"
              }
            ]
          },
          {
            "collectionURL": "https://github.com",
            "cpes": [
              "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "modules": [
              "'Elixir.Tesla.Multipart'"
            ],
            "packageName": "elixir-tesla/tesla",
            "packageURL": "pkg:github/elixir-tesla/tesla",
            "product": "tesla",
            "programFiles": [
              "lib/tesla/multipart.ex"
            ],
            "programRoutines": [
              {
                "name": "'Elixir.Tesla.Multipart':add_content_type_param/2"
              },
              {
                "name": "'Elixir.Tesla.Multipart':headers/1"
              }
            ],
            "repo": "https://github.com/elixir-tesla/tesla",
            "vendor": "elixir-tesla",
            "versions": [
              {
                "lessThan": "23601edac5d22ba9407b427967b5bdbda201aec2",
                "status": "affected",
                "version": "6ebfdb9abe9c6f119408045b933d82462decd351",
                "versionType": "git"
              }
            ]
          }
        ],
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "876BFB6A-2010-4450-9EA4-F4AF4B78F93F",
                "versionEndExcluding": "1.18.3",
                "versionStartIncluding": "0.8.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_type_param/2 appends caller-supplied strings to the multipart content_type_params list without validating for CR (\\r) or LF (\\n) characters. Tesla.Multipart.headers/1 then joins these params verbatim with \"; \" to construct the outgoing Content-Type header value. A param containing \\r\\n splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into add_content_type_param/2 is affected.\n\nThis issue affects tesla: from 0.8.0 before 1.18.3."
      },
      {
        "lang": "es",
        "value": "La vulnerabilidad de Neutralización Inadecuada de Secuencias CRLF en Encabezados HTTP ('División de Solicitud/Respuesta HTTP') en elixir-tesla tesla permite la inyección de encabezados HTTP a través de Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_type_param/2 añade cadenas proporcionadas por el llamador a la lista multipart content_type_params sin validar los caracteres CR (\\r) o LF (\\n). Tesla.Multipart.headers/1 luego une estos parámetros textualmente con '; ' para construir el valor del encabezado Content-Type saliente. Un parámetro que contiene \\r\\n divide la línea del encabezado, permitiendo que se inyecten encabezados arbitrarios en la solicitud HTTP saliente. Cualquier aplicación que reenvíe entrada no confiable (como un charset o una cadena de parámetro proporcionados por el usuario) a add_content_type_param/2 se ve afectada.\n\nEste problema afecta a tesla: desde 0.8.0 antes de 1.18.3."
      }
    ],
    "id": "CVE-2026-48596",
    "lastModified": "2026-09-24T21:17:13.370",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 1.4,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "NOT_DEFINED",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-48596",
            "options": [
              {
                "exploitation": "poc"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-06-03T13:01:48.568462Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-06-02T20:16:38.557",
    "references": [
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://cna.erlef.org/cves/CVE-2026-48596.html"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Broken Link"
        ],
        "url": "https://github.com/elixir-tesla/tesla/commit/23601edac5d22ba9407b427967b5bdbda201aec2"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "url": "https://github.com/elixir-tesla/tesla/commit/6ebfdb9abe9c6f119408045b933d82462decd351"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Exploit",
          "Vendor Advisory"
        ],
        "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48596"
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "tags": [
          "Exploit",
          "Vendor Advisory"
        ],
        "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w"
      }
    ],
    "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-113"
          }
        ],
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ]
  }
}

—

Fixed in

fixed_in

NVD

1.18.3

receipt

Source: NVD
Its words: 1.18.3
Read by: field:cve.affected[].affectedData[].versions[status=affected].lessThan
Said since: 2026-10-06 12:29 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:29 UTC	1.18.3
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://repo.hex.pm",
            "cpes": [
              "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "modules": [
              "'Elixir.Tesla.Multipart'"
            ],
            "packageName": "tesla",
            "packageURL": "pkg:hex/tesla",
            "product": "tesla",
            "programFiles": [
              "lib/tesla/multipart.ex"
            ],
            "programRoutines": [
              {
                "name": "'Elixir.Tesla.Multipart':add_content_type_param/2"
              },
              {
                "name": "'Elixir.Tesla.Multipart':headers/1"
              }
            ],
            "repo": "https://github.com/elixir-tesla/tesla",
            "vendor": "elixir-tesla",
            "versions": [
              {
                "lessThan": "1.18.3",
                "status": "affected",
                "version": "0.8.0",
                "versionType": "semver"
              }
            ]
          },
          {
            "collectionURL": "https://github.com",
            "cpes": [
              "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "modules": [
              "'Elixir.Tesla.Multipart'"
            ],
            "packageName": "elixir-tesla/tesla",
            "packageURL": "pkg:github/elixir-tesla/tesla",
            "product": "tesla",
            "programFiles": [
              "lib/tesla/multipart.ex"
            ],
            "programRoutines": [
              {
                "name": "'Elixir.Tesla.Multipart':add_content_type_param/2"
              },
              {
                "name": "'Elixir.Tesla.Multipart':headers/1"
              }
            ],
            "repo": "https://github.com/elixir-tesla/tesla",
            "vendor": "elixir-tesla",
            "versions": [
              {
                "lessThan": "23601edac5d22ba9407b427967b5bdbda201aec2",
                "status": "affected",
                "version": "6ebfdb9abe9c6f119408045b933d82462decd351",
                "versionType": "git"
              }
            ]
          }
        ],
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "876BFB6A-2010-4450-9EA4-F4AF4B78F93F",
                "versionEndExcluding": "1.18.3",
                "versionStartIncluding": "0.8.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_type_param/2 appends caller-supplied strings to the multipart content_type_params list without validating for CR (\\r) or LF (\\n) characters. Tesla.Multipart.headers/1 then joins these params verbatim with \"; \" to construct the outgoing Content-Type header value. A param containing \\r\\n splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into add_content_type_param/2 is affected.\n\nThis issue affects tesla: from 0.8.0 before 1.18.3."
      },
      {
        "lang": "es",
        "value": "La vulnerabilidad de Neutralización Inadecuada de Secuencias CRLF en Encabezados HTTP ('División de Solicitud/Respuesta HTTP') en elixir-tesla tesla permite la inyección de encabezados HTTP a través de Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_type_param/2 añade cadenas proporcionadas por el llamador a la lista multipart content_type_params sin validar los caracteres CR (\\r) o LF (\\n). Tesla.Multipart.headers/1 luego une estos parámetros textualmente con '; ' para construir el valor del encabezado Content-Type saliente. Un parámetro que contiene \\r\\n divide la línea del encabezado, permitiendo que se inyecten encabezados arbitrarios en la solicitud HTTP saliente. Cualquier aplicación que reenvíe entrada no confiable (como un charset o una cadena de parámetro proporcionados por el usuario) a add_content_type_param/2 se ve afectada.\n\nEste problema afecta a tesla: desde 0.8.0 antes de 1.18.3."
      }
    ],
    "id": "CVE-2026-48596",
    "lastModified": "2026-09-24T21:17:13.370",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 1.4,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "NOT_DEFINED",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-48596",
            "options": [
              {
                "exploitation": "poc"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-06-03T13:01:48.568462Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-06-02T20:16:38.557",
    "references": [
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://cna.erlef.org/cves/CVE-2026-48596.html"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Broken Link"
        ],
        "url": "https://github.com/elixir-tesla/tesla/commit/23601edac5d22ba9407b427967b5bdbda201aec2"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "url": "https://github.com/elixir-tesla/tesla/commit/6ebfdb9abe9c6f119408045b933d82462decd351"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Exploit",
          "Vendor Advisory"
        ],
        "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48596"
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "tags": [
          "Exploit",
          "Vendor Advisory"
        ],
        "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w"
      }
    ],
    "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-113"
          }
        ],
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ]
  }
}

—

Product

product

NVD

tesla

receipt

Source: NVD
Its words: tesla
Read by: field:cve.affected[].affectedData[].product
Said since: 2026-09-29 17:49 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-09-29 17:49 UTC	tesla
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://repo.hex.pm",
            "cpes": [
              "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "modules": [
              "'Elixir.Tesla.Multipart'"
            ],
            "packageName": "tesla",
            "packageURL": "pkg:hex/tesla",
            "product": "tesla",
            "programFiles": [
              "lib/tesla/multipart.ex"
            ],
            "programRoutines": [
              {
                "name": "'Elixir.Tesla.Multipart':add_content_type_param/2"
              },
              {
                "name": "'Elixir.Tesla.Multipart':headers/1"
              }
            ],
            "repo": "https://github.com/elixir-tesla/tesla",
            "vendor": "elixir-tesla",
            "versions": [
              {
                "lessThan": "1.18.3",
                "status": "affected",
                "version": "0.8.0",
                "versionType": "semver"
              }
            ]
          },
          {
            "collectionURL": "https://github.com",
            "cpes": [
              "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "modules": [
              "'Elixir.Tesla.Multipart'"
            ],
            "packageName": "elixir-tesla/tesla",
            "packageURL": "pkg:github/elixir-tesla/tesla",
            "product": "tesla",
            "programFiles": [
              "lib/tesla/multipart.ex"
            ],
            "programRoutines": [
              {
                "name": "'Elixir.Tesla.Multipart':add_content_type_param/2"
              },
              {
                "name": "'Elixir.Tesla.Multipart':headers/1"
              }
            ],
            "repo": "https://github.com/elixir-tesla/tesla",
            "vendor": "elixir-tesla",
            "versions": [
              {
                "lessThan": "23601edac5d22ba9407b427967b5bdbda201aec2",
                "status": "affected",
                "version": "6ebfdb9abe9c6f119408045b933d82462decd351",
                "versionType": "git"
              }
            ]
          }
        ],
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "876BFB6A-2010-4450-9EA4-F4AF4B78F93F",
                "versionEndExcluding": "1.18.3",
                "versionStartIncluding": "0.8.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_type_param/2 appends caller-supplied strings to the multipart content_type_params list without validating for CR (\\r) or LF (\\n) characters. Tesla.Multipart.headers/1 then joins these params verbatim with \"; \" to construct the outgoing Content-Type header value. A param containing \\r\\n splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into add_content_type_param/2 is affected.\n\nThis issue affects tesla: from 0.8.0 before 1.18.3."
      },
      {
        "lang": "es",
        "value": "La vulnerabilidad de Neutralización Inadecuada de Secuencias CRLF en Encabezados HTTP ('División de Solicitud/Respuesta HTTP') en elixir-tesla tesla permite la inyección de encabezados HTTP a través de Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_type_param/2 añade cadenas proporcionadas por el llamador a la lista multipart content_type_params sin validar los caracteres CR (\\r) o LF (\\n). Tesla.Multipart.headers/1 luego une estos parámetros textualmente con '; ' para construir el valor del encabezado Content-Type saliente. Un parámetro que contiene \\r\\n divide la línea del encabezado, permitiendo que se inyecten encabezados arbitrarios en la solicitud HTTP saliente. Cualquier aplicación que reenvíe entrada no confiable (como un charset o una cadena de parámetro proporcionados por el usuario) a add_content_type_param/2 se ve afectada.\n\nEste problema afecta a tesla: desde 0.8.0 antes de 1.18.3."
      }
    ],
    "id": "CVE-2026-48596",
    "lastModified": "2026-09-24T21:17:13.370",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 1.4,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "NOT_DEFINED",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-48596",
            "options": [
              {
                "exploitation": "poc"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-06-03T13:01:48.568462Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-06-02T20:16:38.557",
    "references": [
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://cna.erlef.org/cves/CVE-2026-48596.html"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Broken Link"
        ],
        "url": "https://github.com/elixir-tesla/tesla/commit/23601edac5d22ba9407b427967b5bdbda201aec2"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "url": "https://github.com/elixir-tesla/tesla/commit/6ebfdb9abe9c6f119408045b933d82462decd351"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Exploit",
          "Vendor Advisory"
        ],
        "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48596"
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "tags": [
          "Exploit",
          "Vendor Advisory"
        ],
        "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w"
      }
    ],
    "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-113"
          }
        ],
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ]
  }
}

—

Severity

severity

NVD

LOW

From 0.1 to 3.9.

receipt

Source: NVD
Its words: LOW
Read by: field:cve.metrics.cvssMetricV31[type=Primary].cvssData.baseSeverity || field:cve.metrics.cvssMetricV31[].cvssData.baseSeverity
Said since: 2026-10-06 12:29 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:29 UTC	LOW
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://repo.hex.pm",
            "cpes": [
              "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "modules": [
              "'Elixir.Tesla.Multipart'"
            ],
            "packageName": "tesla",
            "packageURL": "pkg:hex/tesla",
            "product": "tesla",
            "programFiles": [
              "lib/tesla/multipart.ex"
            ],
            "programRoutines": [
              {
                "name": "'Elixir.Tesla.Multipart':add_content_type_param/2"
              },
              {
                "name": "'Elixir.Tesla.Multipart':headers/1"
              }
            ],
            "repo": "https://github.com/elixir-tesla/tesla",
            "vendor": "elixir-tesla",
            "versions": [
              {
                "lessThan": "1.18.3",
                "status": "affected",
                "version": "0.8.0",
                "versionType": "semver"
              }
            ]
          },
          {
            "collectionURL": "https://github.com",
            "cpes": [
              "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "modules": [
              "'Elixir.Tesla.Multipart'"
            ],
            "packageName": "elixir-tesla/tesla",
            "packageURL": "pkg:github/elixir-tesla/tesla",
            "product": "tesla",
            "programFiles": [
              "lib/tesla/multipart.ex"
            ],
            "programRoutines": [
              {
                "name": "'Elixir.Tesla.Multipart':add_content_type_param/2"
              },
              {
                "name": "'Elixir.Tesla.Multipart':headers/1"
              }
            ],
            "repo": "https://github.com/elixir-tesla/tesla",
            "vendor": "elixir-tesla",
            "versions": [
              {
                "lessThan": "23601edac5d22ba9407b427967b5bdbda201aec2",
                "status": "affected",
                "version": "6ebfdb9abe9c6f119408045b933d82462decd351",
                "versionType": "git"
              }
            ]
          }
        ],
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "876BFB6A-2010-4450-9EA4-F4AF4B78F93F",
                "versionEndExcluding": "1.18.3",
                "versionStartIncluding": "0.8.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_type_param/2 appends caller-supplied strings to the multipart content_type_params list without validating for CR (\\r) or LF (\\n) characters. Tesla.Multipart.headers/1 then joins these params verbatim with \"; \" to construct the outgoing Content-Type header value. A param containing \\r\\n splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into add_content_type_param/2 is affected.\n\nThis issue affects tesla: from 0.8.0 before 1.18.3."
      },
      {
        "lang": "es",
        "value": "La vulnerabilidad de Neutralización Inadecuada de Secuencias CRLF en Encabezados HTTP ('División de Solicitud/Respuesta HTTP') en elixir-tesla tesla permite la inyección de encabezados HTTP a través de Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_type_param/2 añade cadenas proporcionadas por el llamador a la lista multipart content_type_params sin validar los caracteres CR (\\r) o LF (\\n). Tesla.Multipart.headers/1 luego une estos parámetros textualmente con '; ' para construir el valor del encabezado Content-Type saliente. Un parámetro que contiene \\r\\n divide la línea del encabezado, permitiendo que se inyecten encabezados arbitrarios en la solicitud HTTP saliente. Cualquier aplicación que reenvíe entrada no confiable (como un charset o una cadena de parámetro proporcionados por el usuario) a add_content_type_param/2 se ve afectada.\n\nEste problema afecta a tesla: desde 0.8.0 antes de 1.18.3."
      }
    ],
    "id": "CVE-2026-48596",
    "lastModified": "2026-09-24T21:17:13.370",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 1.4,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "NOT_DEFINED",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-48596",
            "options": [
              {
                "exploitation": "poc"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-06-03T13:01:48.568462Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-06-02T20:16:38.557",
    "references": [
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://cna.erlef.org/cves/CVE-2026-48596.html"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Broken Link"
        ],
        "url": "https://github.com/elixir-tesla/tesla/commit/23601edac5d22ba9407b427967b5bdbda201aec2"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "url": "https://github.com/elixir-tesla/tesla/commit/6ebfdb9abe9c6f119408045b933d82462decd351"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Exploit",
          "Vendor Advisory"
        ],
        "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48596"
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "tags": [
          "Exploit",
          "Vendor Advisory"
        ],
        "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w"
      }
    ],
    "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-113"
          }
        ],
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ]
  }
}

low

Status

status

NVD

Modified

receipt

Source: NVD
Its words: Modified
Read by: field:cve.vulnStatus
Said since: 2026-09-29 09:45 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://repo.hex.pm",
            "cpes": [
              "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "modules": [
              "'Elixir.Tesla.Multipart'"
            ],
            "packageName": "tesla",
            "packageURL": "pkg:hex/tesla",
            "product": "tesla",
            "programFiles": [
              "lib/tesla/multipart.ex"
            ],
            "programRoutines": [
              {
                "name": "'Elixir.Tesla.Multipart':add_content_type_param/2"
              },
              {
                "name": "'Elixir.Tesla.Multipart':headers/1"
              }
            ],
            "repo": "https://github.com/elixir-tesla/tesla",
            "vendor": "elixir-tesla",
            "versions": [
              {
                "lessThan": "1.18.3",
                "status": "affected",
                "version": "0.8.0",
                "versionType": "semver"
              }
            ]
          },
          {
            "collectionURL": "https://github.com",
            "cpes": [
              "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "modules": [
              "'Elixir.Tesla.Multipart'"
            ],
            "packageName": "elixir-tesla/tesla",
            "packageURL": "pkg:github/elixir-tesla/tesla",
            "product": "tesla",
            "programFiles": [
              "lib/tesla/multipart.ex"
            ],
            "programRoutines": [
              {
                "name": "'Elixir.Tesla.Multipart':add_content_type_param/2"
              },
              {
                "name": "'Elixir.Tesla.Multipart':headers/1"
              }
            ],
            "repo": "https://github.com/elixir-tesla/tesla",
            "vendor": "elixir-tesla",
            "versions": [
              {
                "lessThan": "23601edac5d22ba9407b427967b5bdbda201aec2",
                "status": "affected",
                "version": "6ebfdb9abe9c6f119408045b933d82462decd351",
                "versionType": "git"
              }
            ]
          }
        ],
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "876BFB6A-2010-4450-9EA4-F4AF4B78F93F",
                "versionEndExcluding": "1.18.3",
                "versionStartIncluding": "0.8.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_type_param/2 appends caller-supplied strings to the multipart content_type_params list without validating for CR (\\r) or LF (\\n) characters. Tesla.Multipart.headers/1 then joins these params verbatim with \"; \" to construct the outgoing Content-Type header value. A param containing \\r\\n splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into add_content_type_param/2 is affected.\n\nThis issue affects tesla: from 0.8.0 before 1.18.3."
      },
      {
        "lang": "es",
        "value": "La vulnerabilidad de Neutralización Inadecuada de Secuencias CRLF en Encabezados HTTP ('División de Solicitud/Respuesta HTTP') en elixir-tesla tesla permite la inyección de encabezados HTTP a través de Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_type_param/2 añade cadenas proporcionadas por el llamador a la lista multipart content_type_params sin validar los caracteres CR (\\r) o LF (\\n). Tesla.Multipart.headers/1 luego une estos parámetros textualmente con '; ' para construir el valor del encabezado Content-Type saliente. Un parámetro que contiene \\r\\n divide la línea del encabezado, permitiendo que se inyecten encabezados arbitrarios en la solicitud HTTP saliente. Cualquier aplicación que reenvíe entrada no confiable (como un charset o una cadena de parámetro proporcionados por el usuario) a add_content_type_param/2 se ve afectada.\n\nEste problema afecta a tesla: desde 0.8.0 antes de 1.18.3."
      }
    ],
    "id": "CVE-2026-48596",
    "lastModified": "2026-09-24T21:17:13.370",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 1.4,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "NOT_DEFINED",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-48596",
            "options": [
              {
                "exploitation": "poc"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-06-03T13:01:48.568462Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-06-02T20:16:38.557",
    "references": [
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://cna.erlef.org/cves/CVE-2026-48596.html"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Broken Link"
        ],
        "url": "https://github.com/elixir-tesla/tesla/commit/23601edac5d22ba9407b427967b5bdbda201aec2"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "url": "https://github.com/elixir-tesla/tesla/commit/6ebfdb9abe9c6f119408045b933d82462decd351"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Exploit",
          "Vendor Advisory"
        ],
        "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48596"
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "tags": [
          "Exploit",
          "Vendor Advisory"
        ],
        "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w"
      }
    ],
    "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-113"
          }
        ],
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ]
  }
}

—

Technical impact

technical_impact

NVD

partial

The attacker gains limited control, or limited information.

receipt

Source: NVD
Its words: partial
Read by: field:cve.metrics.ssvcV203[].ssvcData.options[].technicalImpact
Said since: 2026-10-06 12:29 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:29 UTC	partial
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://repo.hex.pm",
            "cpes": [
              "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "modules": [
              "'Elixir.Tesla.Multipart'"
            ],
            "packageName": "tesla",
            "packageURL": "pkg:hex/tesla",
            "product": "tesla",
            "programFiles": [
              "lib/tesla/multipart.ex"
            ],
            "programRoutines": [
              {
                "name": "'Elixir.Tesla.Multipart':add_content_type_param/2"
              },
              {
                "name": "'Elixir.Tesla.Multipart':headers/1"
              }
            ],
            "repo": "https://github.com/elixir-tesla/tesla",
            "vendor": "elixir-tesla",
            "versions": [
              {
                "lessThan": "1.18.3",
                "status": "affected",
                "version": "0.8.0",
                "versionType": "semver"
              }
            ]
          },
          {
            "collectionURL": "https://github.com",
            "cpes": [
              "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "modules": [
              "'Elixir.Tesla.Multipart'"
            ],
            "packageName": "elixir-tesla/tesla",
            "packageURL": "pkg:github/elixir-tesla/tesla",
            "product": "tesla",
            "programFiles": [
              "lib/tesla/multipart.ex"
            ],
            "programRoutines": [
              {
                "name": "'Elixir.Tesla.Multipart':add_content_type_param/2"
              },
              {
                "name": "'Elixir.Tesla.Multipart':headers/1"
              }
            ],
            "repo": "https://github.com/elixir-tesla/tesla",
            "vendor": "elixir-tesla",
            "versions": [
              {
                "lessThan": "23601edac5d22ba9407b427967b5bdbda201aec2",
                "status": "affected",
                "version": "6ebfdb9abe9c6f119408045b933d82462decd351",
                "versionType": "git"
              }
            ]
          }
        ],
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "876BFB6A-2010-4450-9EA4-F4AF4B78F93F",
                "versionEndExcluding": "1.18.3",
                "versionStartIncluding": "0.8.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_type_param/2 appends caller-supplied strings to the multipart content_type_params list without validating for CR (\\r) or LF (\\n) characters. Tesla.Multipart.headers/1 then joins these params verbatim with \"; \" to construct the outgoing Content-Type header value. A param containing \\r\\n splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into add_content_type_param/2 is affected.\n\nThis issue affects tesla: from 0.8.0 before 1.18.3."
      },
      {
        "lang": "es",
        "value": "La vulnerabilidad de Neutralización Inadecuada de Secuencias CRLF en Encabezados HTTP ('División de Solicitud/Respuesta HTTP') en elixir-tesla tesla permite la inyección de encabezados HTTP a través de Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_type_param/2 añade cadenas proporcionadas por el llamador a la lista multipart content_type_params sin validar los caracteres CR (\\r) o LF (\\n). Tesla.Multipart.headers/1 luego une estos parámetros textualmente con '; ' para construir el valor del encabezado Content-Type saliente. Un parámetro que contiene \\r\\n divide la línea del encabezado, permitiendo que se inyecten encabezados arbitrarios en la solicitud HTTP saliente. Cualquier aplicación que reenvíe entrada no confiable (como un charset o una cadena de parámetro proporcionados por el usuario) a add_content_type_param/2 se ve afectada.\n\nEste problema afecta a tesla: desde 0.8.0 antes de 1.18.3."
      }
    ],
    "id": "CVE-2026-48596",
    "lastModified": "2026-09-24T21:17:13.370",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 1.4,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "NOT_DEFINED",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-48596",
            "options": [
              {
                "exploitation": "poc"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-06-03T13:01:48.568462Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-06-02T20:16:38.557",
    "references": [
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://cna.erlef.org/cves/CVE-2026-48596.html"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Broken Link"
        ],
        "url": "https://github.com/elixir-tesla/tesla/commit/23601edac5d22ba9407b427967b5bdbda201aec2"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "url": "https://github.com/elixir-tesla/tesla/commit/6ebfdb9abe9c6f119408045b933d82462decd351"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Exploit",
          "Vendor Advisory"
        ],
        "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48596"
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "tags": [
          "Exploit",
          "Vendor Advisory"
        ],
        "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w"
      }
    ],
    "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-113"
          }
        ],
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ]
  }
}

—

Vendor

vendor

NVD

elixir-tesla

receipt

Source: NVD
Its words: elixir-tesla
Read by: field:cve.affected[].affectedData[].vendor
Said since: 2026-09-29 17:49 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-09-29 17:49 UTC	elixir-tesla
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://repo.hex.pm",
            "cpes": [
              "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "modules": [
              "'Elixir.Tesla.Multipart'"
            ],
            "packageName": "tesla",
            "packageURL": "pkg:hex/tesla",
            "product": "tesla",
            "programFiles": [
              "lib/tesla/multipart.ex"
            ],
            "programRoutines": [
              {
                "name": "'Elixir.Tesla.Multipart':add_content_type_param/2"
              },
              {
                "name": "'Elixir.Tesla.Multipart':headers/1"
              }
            ],
            "repo": "https://github.com/elixir-tesla/tesla",
            "vendor": "elixir-tesla",
            "versions": [
              {
                "lessThan": "1.18.3",
                "status": "affected",
                "version": "0.8.0",
                "versionType": "semver"
              }
            ]
          },
          {
            "collectionURL": "https://github.com",
            "cpes": [
              "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "modules": [
              "'Elixir.Tesla.Multipart'"
            ],
            "packageName": "elixir-tesla/tesla",
            "packageURL": "pkg:github/elixir-tesla/tesla",
            "product": "tesla",
            "programFiles": [
              "lib/tesla/multipart.ex"
            ],
            "programRoutines": [
              {
                "name": "'Elixir.Tesla.Multipart':add_content_type_param/2"
              },
              {
                "name": "'Elixir.Tesla.Multipart':headers/1"
              }
            ],
            "repo": "https://github.com/elixir-tesla/tesla",
            "vendor": "elixir-tesla",
            "versions": [
              {
                "lessThan": "23601edac5d22ba9407b427967b5bdbda201aec2",
                "status": "affected",
                "version": "6ebfdb9abe9c6f119408045b933d82462decd351",
                "versionType": "git"
              }
            ]
          }
        ],
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:elixir-tesla:tesla:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "876BFB6A-2010-4450-9EA4-F4AF4B78F93F",
                "versionEndExcluding": "1.18.3",
                "versionStartIncluding": "0.8.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_type_param/2 appends caller-supplied strings to the multipart content_type_params list without validating for CR (\\r) or LF (\\n) characters. Tesla.Multipart.headers/1 then joins these params verbatim with \"; \" to construct the outgoing Content-Type header value. A param containing \\r\\n splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into add_content_type_param/2 is affected.\n\nThis issue affects tesla: from 0.8.0 before 1.18.3."
      },
      {
        "lang": "es",
        "value": "La vulnerabilidad de Neutralización Inadecuada de Secuencias CRLF en Encabezados HTTP ('División de Solicitud/Respuesta HTTP') en elixir-tesla tesla permite la inyección de encabezados HTTP a través de Tesla.Multipart.add_content_type_param/2.\n\nTesla.Multipart.add_content_type_param/2 añade cadenas proporcionadas por el llamador a la lista multipart content_type_params sin validar los caracteres CR (\\r) o LF (\\n). Tesla.Multipart.headers/1 luego une estos parámetros textualmente con '; ' para construir el valor del encabezado Content-Type saliente. Un parámetro que contiene \\r\\n divide la línea del encabezado, permitiendo que se inyecten encabezados arbitrarios en la solicitud HTTP saliente. Cualquier aplicación que reenvíe entrada no confiable (como un charset o una cadena de parámetro proporcionados por el usuario) a add_content_type_param/2 se ve afectada.\n\nEste problema afecta a tesla: desde 0.8.0 antes de 1.18.3."
      }
    ],
    "id": "CVE-2026-48596",
    "lastModified": "2026-09-24T21:17:13.370",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 1.4,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "NOT_DEFINED",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-48596",
            "options": [
              {
                "exploitation": "poc"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-06-03T13:01:48.568462Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-06-02T20:16:38.557",
    "references": [
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://cna.erlef.org/cves/CVE-2026-48596.html"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Broken Link"
        ],
        "url": "https://github.com/elixir-tesla/tesla/commit/23601edac5d22ba9407b427967b5bdbda201aec2"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "url": "https://github.com/elixir-tesla/tesla/commit/6ebfdb9abe9c6f119408045b933d82462decd351"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Exploit",
          "Vendor Advisory"
        ],
        "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w"
      },
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48596"
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "tags": [
          "Exploit",
          "Vendor Advisory"
        ],
        "url": "https://github.com/elixir-tesla/tesla/security/advisories/GHSA-q7jx-v53g-848w"
      }
    ],
    "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-113"
          }
        ],
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ]
  }
}

—

Every claim, by kind

vulnerability

zetlyn/cve-nvd · 2026-06-02

automatable no cvss 3.7 cvss4 2.1 cvss4_vector CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X cvss_vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N cwe CWE-113 exploitation poc fixed_in 1.18.3 product tesla severity LOW status Modified technical_impact partial vendor elixir-tesla

source