{"id":"CVE-2026-49756","aliases":["EEF-CVE-2026-49756","EUVD-2026-35096","GHSA-px9f-whj3-246m"],"status":"published","title":"Multipart form-data header injection in Req via unescaped name/filename/content_type","description":"Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in wojtekmach Req allows multipart parameter smuggling via attacker-influenced part metadata.\n\nReq.Utils.encode_form_part/2 in lib/req/utils.ex builds the per-part headers by interpolating the caller-supplied name, filename, and content_type values directly into the content-disposition and content-type lines with no escaping or CRLF stripping. A value containing \", \\r, or \\n closes the surrounding quoted value and starts a new header line; an additional \\r\\n--\u003cboundary\u003e terminates the current part and prepends a smuggled part of the attacker's choosing.\n\nThis is reachable through every supported way of supplying a part. It is particularly easy when value is a %File.Stream{}, because filename then defaults to Path.basename(stream.path) and POSIX filenames may legitimately contain \\r and \\n. Any application that forwards user-controlled filenames (or field names / MIME types) through Req.post/2 with form_multipart: lets an attacker inject arbitrary headers into the outgoing multipart body or smuggle additional fields and parts into the request the victim service sends downstream.\n\nThis issue affects req: from 0.5.3 before 0.6.0.","severity":{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00207,"percentile":0.10926,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-93"],"published":"2026-06-08T15:20:24Z","modified":"2026-10-28T02:31:05Z","fixes":[{"ecosystem":"Hex","package":"req","fixed_in":["0.6.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Hex","package":"req","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.3"},{"fixed":"0.6.0"}]}]},{"source":"osv","ecosystem":"Hex","package":"req","ranges":[{"type":"SEMVER","events":[{"introduced":"0.5.3"},{"fixed":"0.6.0"}]}],"versions":["0.5.10","0.5.11","0.5.12","0.5.13","0.5.14","0.5.15","0.5.16","0.5.17","0.5.18","0.5.3","0.5.4","0.5.5","0.5.6","0.5.7","0.5.8","0.5.9"]},{"source":"osv","ecosystem":"Hex","package":"req","ranges":[{"type":"SEMVER","events":[{"introduced":"0.5.3"},{"fixed":"0.6.0"}]}],"versions":["0.5.10","0.5.11","0.5.12","0.5.13","0.5.14","0.5.15","0.5.16","0.5.17","0.5.18","0.5.3","0.5.4","0.5.5","0.5.6","0.5.7","0.5.8","0.5.9"]}],"products":[{"vendor":"wojtekmach","product":"req"}],"references":[{"url":"https://github.com/wojtekmach/req/security/advisories/GHSA-px9f-whj3-246m","tags":["vendor-advisory","related","exploit","Vendor Advisory","advisory","web"]},{"url":"https://cna.erlef.org/cves/CVE-2026-49756.html","tags":["related","Third Party Advisory","Mitigation","web"]},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-49756","tags":["related","Third Party Advisory","web"]},{"url":"https://github.com/wojtekmach/req/commit/74506ff2c5addf74df85d79dc726e9b2e264a8ba","tags":["patch","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49756","tags":["advisory"]},{"url":"https://github.com/wojtekmach/req/releases/tag/v0.6.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-px9f-whj3-246m"},{"url":"https://github.com","tags":["web"]},{"url":"https://repo.hex.pm","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49756.json","tags":["advisory"]},{"url":"https://github.com/wojtekmach/req","tags":["package"]},{"url":"https://github.com/wojtekmach/req.git","tags":["package"]},{"url":"https://hex.pm/packages/req","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-49756","title":"Multipart form-data header injection in Req via unescaped name/filename/content_type","description":"Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in wojtekmach Req allows multipart parameter smuggling via attacker-influenced part metadata.\n\nReq.Utils.encode_form_part/2 in lib/req/utils.ex builds the per-part headers by interpolating the caller-supplied name, filename, and content_type values directly into the content-disposition and content-type lines with no escaping or CRLF stripping. A value containing \", \\r, or \\n closes the surrounding quoted value and starts a new header line; an additional \\r\\n--\u003cboundary\u003e terminates the current part and prepends a smuggled part of the attacker's choosing.\n\nThis is reachable through every supported way of supplying a part. It is particularly easy when value is a %File.Stream{}, because filename then defaults to Path.basename(stream.path) and POSIX filenames may legitimately contain \\r and \\n. Any application that forwards user-controlled filenames (or field names / MIME types) through Req.post/2 with form_multipart: lets an attacker inject arbitrary headers into the outgoing multipart body or smuggle additional fields and parts into the request the victim service sends downstream.\n\nThis issue affects req: from 0.5.3 before 0.6.0.","status":"published","published":"2026-06-08T15:20:24.035Z","modified":"2026-06-08T16:34:58.505Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N","level":"low","assessor":"cna"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T13:35:10.963527Z"}],"euvd":[{"id":"EUVD-2026-35096","description":"Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in wojtekmach Req allows multipart parameter smuggling via attacker-influenced part metadata.\n\nReq.Utils.encode_form_part/2 in lib/req/utils.ex builds the per-part headers by interpolating the caller-supplied name, filename, and content_type values directly into the content-disposition and content-type lines with no escaping or CRLF stripping. A value containing \", \\r, or \\n closes the surrounding quoted value and starts a new header line; an additional \\r\\n--\u003cboundary\u003e terminates the current part and prepends a smuggled part of the attacker's choosing.\n\nThis is reachable through every supported way of supplying a part. It is particularly easy when value is a %File.Stream{}, because filename then defaults to Path.basename(stream.path) and POSIX filenames may legitimately contain \\r and \\n. Any application that forwards user-controlled filenames (or field names / MIME types) through Req.post/2 with form_multipart: lets an attacker inject arbitrary headers into the outgoing multipart body or smuggle additional fields and parts into the request the victim service sends downstream.\n\nThis issue affects req: from 0.5.3 before 0.6.0.","status":"published","published":"2026-06-08T15:20:24Z","modified":"2026-06-08T16:34:58Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N","level":"low"}],"updated_at":"2026-11-02T18:20:48.834104Z"}],"ghsa":[{"id":"GHSA-px9f-whj3-246m","title":"Req vulnerable to multipart form-data header injection via unescaped name/filename/content_type","description":"### Summary\n\nReq's multipart form encoder interpolates the per-part `name`, `filename`, and `content_type` directly into the part headers without escaping. An attacker who can influence any of those values can inject CRLF-separated header lines, smuggle additional form fields, or prepend a whole extra part into the request the victim service sends downstream.\n\n### Details\n\n`Req.Utils.encode_form_part/2` in `lib/req/utils.ex` builds the per-part header iodata by concatenating the three caller-supplied strings verbatim into `content-disposition: form-data; name=\"\u003cname\u003e\"; filename=\"\u003cfilename\u003e\"` and `content-type: \u003ccontent_type\u003e`. There is no CRLF stripping, no quote escaping, and no validation. A value containing `\"\\r\\n` closes the surrounding quoted value and starts a new header line; an additional `\\r\\n--\u003cboundary\u003e` terminates the current part and lets the attacker prepend a smuggled part.\n\nThe flaw is reachable through every supported way of supplying a part. It is especially easy to hit when `value` is a `%File.Stream{}`, because `filename` then defaults to `Path.basename(stream.path)` and POSIX filenames may legitimately contain `\\r` and `\\n`. RFC 7578 / WHATWG form-data requires percent-encoding `\"`, CR, and LF in these fields; the fix adopts that behavior.\n\n### PoC\n\n1. Construct a malicious `filename` such as `harmless.txt\"\\r\\nX-Smuggled: marker\\r\\nContent-Disposition: form-data; name=\"pwned`.\n2. Call `Req.post!(url, form_multipart: [upload: {\"benign body\", filename: \u003cmalicious\u003e, content_type: \"text/plain\"}])`.\n3. The emitted multipart body contains a real `X-Smuggled:` header line and an extra `Content-Disposition` for `name=\"pwned\"`, alongside Req's legitimate headers.\n\n### Impact\n\nHTTP request smuggling / multipart parameter smuggling in the HTTP client. Any application using Req to send `form_multipart` requests where any of `name`, `filename`, or `content_type` can be influenced by an untrusted source is affected, most commonly upload proxies and re-uploaders that derive `filename` from `Path.basename/1` on a user-controlled path.","status":"published","published":"2026-07-29T15:29:14Z","modified":"2026-07-29T15:29:15Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T14:40:54.767849Z"}],"nvd":[{"id":"CVE-2026-49756","description":"Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in wojtekmach Req allows multipart parameter smuggling via attacker-influenced part metadata.\n\nReq.Utils.encode_form_part/2 in lib/req/utils.ex builds the per-part headers by interpolating the caller-supplied name, filename, and content_type values directly into the content-disposition and content-type lines with no escaping or CRLF stripping. A value containing \", \\r, or \\n closes the surrounding quoted value and starts a new header line; an additional \\r\\n--\u003cboundary\u003e terminates the current part and prepends a smuggled part of the attacker's choosing.\n\nThis is reachable through every supported way of supplying a part. It is particularly easy when value is a %File.Stream{}, because filename then defaults to Path.basename(stream.path) and POSIX filenames may legitimately contain \\r and \\n. Any application that forwards user-controlled filenames (or field names / MIME types) through Req.post/2 with form_multipart: lets an attacker inject arbitrary headers into the outgoing multipart body or smuggle additional fields and parts into the request the victim service sends downstream.\n\nThis issue affects req: from 0.5.3 before 0.6.0.","status":"published","published":"2026-06-08T16:16:44.04Z","modified":"2026-08-18T19:15:38.86Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T14:12:22.73178Z"}],"osv":[{"id":"CVE-2026-49756","title":"Multipart form-data header injection in Req via unescaped name/filename/content_type","description":"Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in wojtekmach Req allows multipart parameter smuggling via attacker-influenced part metadata.\n\nReq.Utils.encode_form_part/2 in lib/req/utils.ex builds the per-part headers by interpolating the caller-supplied name, filename, and content_type values directly into the content-disposition and content-type lines with no escaping or CRLF stripping. A value containing \", \\r, or \\n closes the surrounding quoted value and starts a new header line; an additional \\r\\n--\u003cboundary\u003e terminates the current part and prepends a smuggled part of the attacker's choosing.\n\nThis is reachable through every supported way of supplying a part. It is particularly easy when value is a %File.Stream{}, because filename then defaults to Path.basename(stream.path) and POSIX filenames may legitimately contain \\r and \\n. Any application that forwards user-controlled filenames (or field names / MIME types) through Req.post/2 with form_multipart: lets an attacker inject arbitrary headers into the outgoing multipart body or smuggle additional fields and parts into the request the victim service sends downstream.\n\nThis issue affects req: from 0.5.3 before 0.6.0.","status":"published","published":"2026-06-08T15:20:24.035Z","modified":"2026-10-28T02:31:05.931161313Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N","level":"low"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T15:45:07.060148Z"},{"id":"EEF-CVE-2026-49756","title":"Multipart form-data header injection in Req via unescaped name/filename/content_type","description":"## Summary\n\nImproper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in wojtekmach Req allows multipart parameter smuggling via attacker-influenced part metadata.\n\nReq.Utils.encode\\_form\\_part/2 in lib/req/utils.ex builds the per-part headers by interpolating the caller-supplied name, filename, and content\\_type values directly into the content-disposition and content-type lines with no escaping or CRLF stripping. A value containing \", \\\\r, or \\\\n closes the surrounding quoted value and starts a new header line; an additional \\\\r\\\\n--\u003cboundary\u003e terminates the current part and prepends a smuggled part of the attacker's choosing.\n\nThis is reachable through every supported way of supplying a part. It is particularly easy when value is a %File.Stream{}, because filename then defaults to Path.basename(stream.path) and POSIX filenames may legitimately contain \\\\r and \\\\n. Any application that forwards user-controlled filenames (or field names / MIME types) through Req.post/2 with form\\_multipart: lets an attacker inject arbitrary headers into the outgoing multipart body or smuggle additional fields and parts into the request the victim service sends downstream.\n\nThis issue affects req: from 0.5.3 before 0.6.0.\n\n## Workarounds\n\nSanitize attacker-influenced name, filename, and content\\_type values before passing them to Req.post/2 with form\\_multipart:. At minimum, reject (or strip) any value containing \\\\r, \\\\n, or \". When forwarding uploads, derive filename from a normalised string rather than Path.basename/1 on a user-controlled path.","status":"published","published":"2026-06-08T15:20:24.035Z","modified":"2026-09-08T03:45:05.88917625Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N","level":"low"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T15:46:33.520522Z"},{"id":"GHSA-px9f-whj3-246m","title":"Req vulnerable to multipart form-data header injection via unescaped name/filename/content_type","description":"### Summary\n\nReq's multipart form encoder interpolates the per-part `name`, `filename`, and `content_type` directly into the part headers without escaping. An attacker who can influence any of those values can inject CRLF-separated header lines, smuggle additional form fields, or prepend a whole extra part into the request the victim service sends downstream.\n\n### Details\n\n`Req.Utils.encode_form_part/2` in `lib/req/utils.ex` builds the per-part header iodata by concatenating the three caller-supplied strings verbatim into `content-disposition: form-data; name=\"\u003cname\u003e\"; filename=\"\u003cfilename\u003e\"` and `content-type: \u003ccontent_type\u003e`. There is no CRLF stripping, no quote escaping, and no validation. A value containing `\"\\r\\n` closes the surrounding quoted value and starts a new header line; an additional `\\r\\n--\u003cboundary\u003e` terminates the current part and lets the attacker prepend a smuggled part.\n\nThe flaw is reachable through every supported way of supplying a part. It is especially easy to hit when `value` is a `%File.Stream{}`, because `filename` then defaults to `Path.basename(stream.path)` and POSIX filenames may legitimately contain `\\r` and `\\n`. RFC 7578 / WHATWG form-data requires percent-encoding `\"`, CR, and LF in these fields; the fix adopts that behavior.\n\n### PoC\n\n1. Construct a malicious `filename` such as `harmless.txt\"\\r\\nX-Smuggled: marker\\r\\nContent-Disposition: form-data; name=\"pwned`.\n2. Call `Req.post!(url, form_multipart: [upload: {\"benign body\", filename: \u003cmalicious\u003e, content_type: \"text/plain\"}])`.\n3. The emitted multipart body contains a real `X-Smuggled:` header line and an extra `Content-Disposition` for `name=\"pwned\"`, alongside Req's legitimate headers.\n\n### Impact\n\nHTTP request smuggling / multipart parameter smuggling in the HTTP client. Any application using Req to send `form_multipart` requests where any of `name`, `filename`, or `content_type` can be influenced by an untrusted source is affected, most commonly upload proxies and re-uploaders that derive `filename` from `Path.basename/1` on a user-controlled path.","status":"published","published":"2026-07-29T15:29:14Z","modified":"2026-07-29T15:52:24.126273077Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T15:46:53.700556Z"}]}}