CVE-2026-49756

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in wojtekmach Req allows multipart parameter smuggling via attacker-influenced part metadata. Req.Utils.encode_form_part/2 in lib/req/utils.ex builds the per-part headers by interpolating the caller-supplied name, filename, and content_type values directly into the content-disposition and content-type lines with no escaping or CRLF stripping. A value containing ", \r, or \n closes the surrounding quoted value and starts a new header line; an additional \r\n--<boundary> terminates the current part and prepends a smuggled part of the attacker's choosing. This is reachable through every supported way of supplying a part. It is particularly easy when value is a %File.Stream{}, because filename then defaults to Path.basename(stream.path) and POSIX filenames may legitimately contain \r and \n. Any application that forwards user-controlled filenames (or field names / MIME types) through Req.post/2 with form_multipart: lets an attacker inject arbitrary headers into the outgoing multipart body or smuggle additional fields and parts into the request the victim service sends downstream. This issue affects req: from 0.5.3 before 0.6.0.

• CWE-93

• https://cna.erlef.org/cves/CVE-2026-49756.htmlThird Party Advisory, Mitigation
• https://github.com/wojtekmach/req/commit/74506ff2c5addf74df85d79dc726e9b2e264a8baPatch
• https://github.com/wojtekmach/req/security/advisories/GHSA-px9f-whj3-246mVendor Advisory
• https://osv.dev/vulnerability/EEF-CVE-2026-49756Third Party Advisory
• https://github.com/wojtekmach/req/security/advisories/GHSA-px9f-whj3-246mVendor Advisory

Published

Jun 8, 2026

Last Modified

Aug 18, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49745Kernel software installed and running inside a Guest VM may …7.8
• CVE-2026-49746Software installed and run as a non-privileged user may cond…7.1
• CVE-2026-4975A vulnerability has been found in Tenda AC15 15.03.05.19. Th…8.8
• CVE-2026-49753Inconsistent Interpretation of HTTP Requests ('HTTP Request/…6.3
• CVE-2026-49754Allocation of Resources Without Limits or Throttling vulnera…8.2
• CVE-2026-49755Improper Handling of Highly Compressed Data (Data Amplificat…7.5
• CVE-2026-49757Authentication Bypass by Spoofing vulnerability in team-alem…9.2
• CVE-2026-49759Stack-based Buffer Overflow vulnerability in Erlang OTP erts…8.2
• CVE-2026-4976A vulnerability was found in Totolink LR350 9.3.5u.6369_B202…8.8
• CVE-2026-49760Stack-based Buffer Overflow vulnerability in Erlang OTP (erl…5.5
• CVE-2026-49762Uncontrolled Resource Consumption vulnerability in the Elixi…5.1
• CVE-2026-49763Unauthenticated PHP Object Injection in Integration for Cont…9.8