Header Injection and Request Smuggling Flaw Fixed in elixir-tesla Multipart Handling

A vulnerability tracked as CVE-2026-48598 was disclosed in the Elixir HTTP client library elixir-tesla, where multipart serialization allowed attacker-controlled metadata to break Content-Disposition headers and alter outbound HTTP requests. The flaw affects Tesla 0.8.0 through before 1.18.3 and stems from unsafe interpolation of multipart disposition parameters in the private part_headers_for_disposition/1 function. If an application accepts untrusted filenames or related metadata and passes them into multipart helpers such as Tesla.Multipart.add_file/3 or add_file_content/4, an attacker could inject headers, smuggle body content, or spoof multipart metadata sent to downstream services.

The project addressed the issue by adding stricter validation to multipart entry points and enforcing RFC-compliant grammar for content-type parameters, multipart part headers, and quoted-string fields including names and filenames. The fix rejects unsafe characters such as CR, LF, NUL, DEL, invalid header characters, and semicolons in content-type parameters, with tests added for header injection and parameter smuggling scenarios. Although the reported severity is low at CVSS 2.1 and exploitation requires a specific application flow involving untrusted file metadata, the flaw could still expose downstream systems to forged requests or secondary trust-boundary failures if multipart metadata is relied upon.