CVE-2026-48598: Multipart Part Header Injection and Request Smuggling in elixir-tesla

The elixir-tesla library serves as a widely adopted HTTP client framework within the Elixir ecosystem, offering modular middleware and simple HTTP request building. One of its crucial components is the Tesla.Multipart module, which handles the serialization of multipart form-data. This format is commonly used to transfer binary file data and associated metadata to upstream web services.

When applications ingest file metadata from unauthenticated users and forward it downstream, they expose a highly sensitive interface. If the client library fails to escape structural characters, this dynamic user input can alter the overall structure of the HTTP multipart message body.

CVE-2026-48598 exposes an input-validation vulnerability classified as CWE-116 within this serialization pipeline. An attacker who controls metadata such as filenames can construct malicious inputs that break out of the header context. This flaw alters downstream boundary evaluations and allows subsequent header fields to be injected.

The underlying flaw resides within the private part_headers_for_disposition/1 function inside lib/tesla/multipart.ex. This function is responsible for iterating over a keyword list of disposition parameters and converting them into format-compliant headers. It serializes these parameters using simple string interpolation without performing escaping or sanitation.

Specifically, the function maps over key-value pairs using the pattern #{k}="#{v}". It joins the mapped values into a semicolon-delimited string and appends a single CRLF sequence to finalize the Content-Disposition line. If a parameter value contains a double-quote character, it prematurely terminates the quoted string boundary.

If the value contains carriage return or line feed characters, it ends the HTTP header line itself. The remaining injected payload is then interpreted as a distinct HTTP header or even a premature body boundary. This structural manipulation is illustrated in the diagram below.

To analyze the vulnerable implementation, observe how parameter values were directly concatenated without character verification in lib/tesla/multipart.ex prior to version 1.18.3:

def part_headers_for_disposition([]), do: []
def part_headers_for_disposition(kvs) do
  ds =
    kvs
    # Vulnerable interpolation lacking escaping or validation
    |> Enum.map(fn {k, v} -> "#{k}=\"#{v}\"" end)
    |> Enum.join("; ")
  ["Content-Disposition: form-data; #{ds}\r\n"]
end

The initial remediation commit bb1a2c3da2775924d96e3db8e315dcc4d5d2246e mitigated this by introducing basic assertion helpers. These checks search for forbidden control characters and double-quotes within each evaluated disposition value:

# Introduced assertion to intercept structural characters
def part_headers_for_disposition(kvs) do
  ds =
    kvs
    |> Enum.map(fn {k, v} ->
      v_str = to_string(v)
      :ok = assert_disposition_value!(k, v_str)
      "#{k}=\"#{v_str}\""
    end)
    |> Enum.join("; ")
  ["content-disposition: form-data; #{ds}\r\n"]
end

To prevent sophisticated bypasses, the subsequent commit 23601edac5d22ba9407b427967b5bdbda201aec2 implemented strict RFC 7230 and RFC 7231 Whitelist validation using binary pattern matching. Rather than simply blocking known bad characters, this implementation validates every character against standard token definition rules.

An attack relies on the target application receiving file metadata from untrusted sources and passing it directly into Tesla.Multipart.add_file/3 or add_file_content/4. For instance, a web service that accepts user uploads and replicates them to a downstream object-store API acts as a potential forwarding proxy.

To exploit this vulnerability, the attacker registers a file upload using a crafted filename containing quotes and line-ending sequences. A typical payload contains a filename like file.txt"\r\nContent-Type: application/x-php\r\n\r\n<?php phpinfo(); ?>\r\n--boundary--. During serialization, the client library constructs the outbound HTTP body using this raw string.

When the downstream system processes the request, it encounters the injected line breaks. It evaluates the injected content-type and body data as separate entities, bypassing filename or extension validations. This allows attackers to perform multipart request smuggling or spoof upload metadata.

The CVSS Base Score is officially rated at 2.1, representing low overall severity due to the local attack vector requirement. Because the library executes inside the context of the calling application, exploitation requires the application itself to expose vulnerable pathways. It does not directly affect the confidentiality, integrity, or availability of the underlying server.

However, the subsequent system integrity rating is classified as low because this vulnerability alters the integrity of data sent to downstream processors. If downstream systems trust the integrity of incoming multipart metadata, they may execute arbitrary commands, allow directory traversal, or process forged requests.

According to the Exploit Prediction Scoring System, the probability of active exploitation in the wild is currently low. Developers must still address this vulnerability since it acts as a secondary exploitation channel inside microservice architectures.

The primary recommendation is to update the tesla dependency to version 1.18.3 or later. This version introduces RFC-compliant character checking that raises an ArgumentError when unescaped characters are detected.

If the dependency cannot be immediately updated, developers must implement strict server-side validation. Filenames and parameter inputs must be filtered to remove double-quotes, carriage returns, and line feeds before calling the client library.

Additionally, applications must wrap multipart creation inside structured try/rescue blocks. Because the patch throws runtime errors when bad input is detected, failing to catch these exceptions can expose the application to denial-of-service vulnerabilities through intentional application crashes.