Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in wojtekmach Req allows multipart parameter smuggling via attacker-influenced part metadata. Req.Utils.encode_form_part/2 …
Low CVSS 3.7
Summary
Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in wojtekmach Req allows multipart parameter smuggling via attacker-influenced part metadata. Req.Utils.encode_form_part/2 in lib/req/utils.ex builds the per-part headers by interpolating the caller-supplied name, filename, and content_type values directly into the content-disposition and content-type lines with no escaping or CRLF stripping. A value containing ", \r, or \n closes the surrounding quoted value and starts…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Sources
- NVD DATABASE
Original Links
- https://cna.erlef.org/cves/CVE-2026-49756.html Third Party Advisory
- https://github.com/wojtekmach/req/commit/74506ff2c5addf74df85d79dc726e9b2e264a8ba Patch
- https://github.com/wojtekmach/req/security/advisories/GHSA-px9f-whj3-246m Vendor Advisory
- https://osv.dev/vulnerability/EEF-CVE-2026-49756 Third Party Advisory
- https://github.com/wojtekmach/req/security/advisories/GHSA-px9f-whj3-246m Vendor Advisory
Timeline
- nvd_ingest NVD