Loading story…
A vulnerability tracked as CVE-2026-48598 was disclosed in the Elixir HTTP client library elixir-tesla, where multipart serialization allowed attacker-controlled metadata to break Content-Disposition headers and alter outbound HTTP requests. The flaw affects Tesla 0.8.0 through before 1.18.3 and stems from unsafe interpolation of multipart disposition parameters in the private part_headers_for_disposition/1 function. If an application accepts untrusted filenames or related metadata and passes them into multipart helpers such as Tesla.Multipart.add_file/3 or add_file_content/4, an attacker could inject headers, smuggle body content, or spoof multipart metadata sent to downstream services.
The project addressed the issue by adding stricter validation to multipart entry points and enforcing RFC-compliant grammar for content-type parameters, multipart part headers, and quoted-string fields including names and filenames. The fix rejects unsafe characters such as CR, LF, NUL, DEL, invalid header characters, and semicolons in content-type parameters, with tests added for header injection and parameter smuggling scenarios. Although the reported severity is low at CVSS 2.1 and exploitation requires a specific application flow involving untrusted file metadata, the flaw could still expose downstream systems to forged requests or secondary trust-boundary failures if multipart metadata is relied upon.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-48598 was publicly reported as a multipart part header injection and request smuggling vulnerability in elixir-tesla affecting versions 0.8.0 through before 1.18.3. The disclosure states that version 1.18.3 fixes the issue through stricter validation after earlier sanitizer work and an RFC-compliant whitelist implementation.
A commit in the elixir-tesla/tesla project added validation to Tesla.Multipart entry points to block unsafe characters and enforce RFC grammar, addressing header injection and multipart parameter smuggling risks. The change was authored by Yordis Prieto, merged into master, tagged v1.20.0, and included tests for injection and smuggling cases.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability in the Axios HTTP client library, tracked as **`CVE-2026-40175`**, allows attackers to turn polluted JavaScript object properties into malicious HTTP headers and abuse outbound requests for **SSRF**, **request smuggling**, and potential **remote code execution**. Researchers said the flaw stems from improper header handling in Axios’s HTTP adapter and unsafe config merging, which can let `Object.prototype` values containing CRLF characters be injected into requests. The issue can be chained with prototype pollution in other npm packages to target internal services, including the AWS EC2 metadata endpoint at `169.254.169.254`, potentially bypassing **IMDSv2** and exposing cloud credentials or broader infrastructure. A public proof-of-concept was released alongside disclosure, raising urgency for defenders even though active exploitation had not been confirmed at the time of reporting. The flaw affects Axios versions before **`1.13.2`**, while maintainers said **`1.15.0`** introduces strict header validation that blocks CRLF-based header injection; organizations were urged to upgrade and audit dependencies such as **`body-parser`**, **`qs`**, and **`minimist`** for prototype pollution paths. One report cited internet-wide estimates of more than **48,000** potentially exposed instances, underscoring the risk of unauthorized internal access and possible full cloud compromise.
Jun 29, 2026
Traefik disclosed and patched multiple vulnerabilities that let unauthenticated attackers bypass authentication and authorization controls by abusing forwarded-header handling. The most severe issue, **`CVE-2026-54763`** with a **CVSS 10.0**, allows BasicAuth, DigestAuth, and ForwardAuth protections to be bypassed through underscore-variant header injection that can spoof identity or authorization context. Two related flaws, **`CVE-2026-54764`** and **`CVE-2026-54765`**, respectively enable bypass of port-based authorization checks in ForwardAuth via injected `X-Forwarded-Proto` values and leak backend context across Kubernetes Gateway API routes that share the same `Service:port`. The disclosures build on earlier high-severity Traefik ForwardAuth bugs, **`CVE-2026-35051`** and **`CVE-2026-39858`**, which exposed protected routes when Traefik was deployed behind an upstream proxy or when downstream systems normalized underscore-form headers such as `X_Forwarded_Proto` and `X_Forwarded_User`. Affected versions span Traefik v2 and v3 releases prior to the vendor fixes, including **2.11.51**, **3.6.22**, and **3.7.6** for the latest issues, with the newer bugs described as evidence that earlier header-sanitization fixes were incomplete. The flaws put services commonly protected by ForwardAuth—such as Grafana, Kibana, Portainer, Kubernetes Dashboard, internal APIs, and admin panels—at risk, although no public exploits were reported at disclosure.
Jul 10, 2026
Two high-severity vulnerabilities were disclosed in **Mbed TLS**, including a buffer overflow in FFDH public key export tracked as `CVE-2026-34875` and a memory-corruption issue tied to serialized SSL context or session structures tracked as `CVE-2026-34877`. The first flaw affects **Mbed TLS through 3.6.5** and **TF-PSA-Crypto 1.0.0**, while the second impacts **Mbed TLS 2.19.0 through 3.6.5** as well as **4.0.0**. Both issues were assigned a `CVSS v3.1` score vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, indicating remotely exploitable conditions with low attack complexity and high impact on confidentiality, integrity, and availability. `CVE-2026-34875` is classified under **CWE-120** and occurs during export of FFDH public keys, creating a buffer overflow condition. `CVE-2026-34877` is associated with **CWE-502** and **CWE-250** and can lead to arbitrary code execution if an attacker can alter serialized SSL context or session data before it is processed. Mbed TLS security advisories were published for both flaws, putting organizations that embed the library in network-facing products, cryptographic services, or TLS-enabled applications on notice to review affected versions and vendor guidance immediately.
Jun 29, 2026