## Summary

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTTP header injection via Tesla.Multipart.add\_content\_type\_param/2.

Tesla.Multipart.add\_content\_type\_param/2 appends caller-supplied strings to the multipart content\_type\_params list without validating for CR (\\r) or LF (\\n) characters. Tesla.Multipart.headers/1 then joins these params verbatim with "; " to construct the outgoing Content-Type header value. A param containing \\r\\n splits the header line, allowing arbitrary headers to be injected into the outbound HTTP request. Any application that forwards untrusted input (such as a user-supplied charset or parameter string) into add\_content\_type\_param/2 is affected.

This issue affects tesla: from 0.8.0 before 1.18.3.

## Workaround

Validate content-type parameter strings before passing them to Tesla.Multipart.add\_content\_type\_param/2, rejecting any value that contains \\r or \\n.

## Configuration

The application must pass untrusted input into Tesla.Multipart.add\_content\_type\_param/2.

## Summary

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in elixir-mint Mint allows HTTP Request Splitting and HTTP Request Smuggling.

In lib/mint/http1/request.ex, the encode\_request\_line/2 function splices the caller-supplied method and target arguments directly into the HTTP/1 request line without any character validation: \[method, ?\\s, target, " HTTP/1.1\\r\\n"\]. An application that forwards attacker-controlled input as the HTTP method or target to Mint.HTTP.request/5 is therefore exposed to request-line CRLF injection: the attacker can terminate the request line early, inject arbitrary headers, and smuggle an entirely separate pipelined HTTP request onto the same TCP connection.

Mint 1.7.0 introduced validate\_request\_target/2, which rejects CRLF and other control characters in the target by default and closes the path/query vector unless the caller opts out via skip\_target\_validation: true. The method field remains unvalidated, so the method-based injection is exploitable under the default Mint configuration on all versions.

This issue affects mint: from 0.1.0 before 1.9.0.

## Summary

Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex\_core (hex\_api modules), hexpm hex (mix\_hex\_api modules), erlang rebar3 (r3\_hex\_api modules) allows Object Injection, Excessive Allocation. This vulnerability is associated with program files src/hex\_api.erl, src/mix\_hex\_api.erl, apps/rebar/src/vendored/r3\_hex\_api.erl and program routines hex\_core:request/4, mix\_hex\_api:request/4, r3\_hex\_api:request/4.

This issue affects hex\_core: from 0.1.0 before 0.12.1; hex: from 2.3.0 before 2.3.2; rebar3: from 3.9.1 before 3.27.0.

CVE ID↕	Published↕	CVSS↓
EEF-CVE-2026-48596	Jun 2, 2026	Low 2.1
EEF-CVE-2026-48861	Jun 2, 2026	Low 2.1
EEF-CVE-2026-21619	Feb 27, 2026	Low 2

Know every vulnerability
before it knows you.

hex CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerabilitybefore it knows you.

hex CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerability
before it knows you.